Why are these things being disclosed before fixes have been rolled out? Is no-one following disclosure protocols any more?

Debian tracker: https://security-tracker.debian.org/tracker/CVE-2026-119618 - hopefully the fix lands soon

Debian has been patched just now and updates available : apache2 2.4.71-1~deb13u1

At least disabling http2 is an easy countermeasure that will probably in most setups not have any real downsides.

If it was even enabled that is.