Apache HTTP Server HTTP/2 flaw CVE-2026-119618 allows unauthenticated RCENew
Apache 2.4.55 through 2.4.70 is affected and 2.4.71 is fixed; Wiz reports no exploit or known attacks.
71
CVE-2026-119618
Race condition RCE in Apache HTTP Server mod_http2
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A race condition in Apache HTTP Server's mod_http2, in assign_headers(), comes from concurrent use of a shared resource without proper synchronization and can lead to remote code execution. It affects Apache HTTP Server 2.4.55 through 2.4.70 and GitHub mod_h2 releases 2.0.8 through 2.0.42. The advisory does not state authentication or user-interaction requirements, or a fixed release.
What to do: Apply Apache's update for CVE-2026-119618. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Apache HTTP Server | from 2.4.55 through 2.4.70 |
| Apache mod_h2 | from 2.0.8 through 2.0.42 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
- Weakness
- CWE-362
In the news
2 storiesApache HTTP Server mod_http2 heap bug can yield RCE (CVE-2026-119618)
The advisory rates the assign_headers race critical and also covers mod_h2 2.0.8 through 2.0.42.
68