Apache HTTP Server mod_http2 heap bug can yield RCE (CVE-2026-119618)
Original title: CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
The advisory rates the assign_headers race critical and also covers mod_h2 2.0.8 through 2.0.42.
Eric Covener reported a critical flaw in Apache HTTP Server's mod_http2. Improper synchronization around a shared resource in assign_headers() can corrupt the heap and lead to remote code execution. Server releases 2.4.55 through 2.4.70 and GitHub mod_h2 releases 2.0.8 through 2.0.42 are affected. Anthropic's OSS Scanner is credited; no fixed version or exploitation status is stated.
Unconfirmed: No fixed release or exploitation status is stated in the post.
- Vendor severity is critical.
- Apache HTTP Server 2.4.55 through 2.4.70 is affected.
- GitHub mod_h2 2.0.8 through 2.0.42 is also affected.
- The bug is in assign_headers() and can lead to RCE.
Impact: Heap corruption that can lead to remote code execution
| Product | Affected |
|---|---|
| Apache Software Foundation Apache HTTP Server | 2.4.55 through 2.4.70 |
| Apache Software Foundation mod_h2 | 2.0.8 through 2.0.42 |
- CVEs
- CVE-2026-119618
- Vendors
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119618 | Race condition RCE in Apache HTTP Server mod_http2 | — | — | PoC |
From the original article
Posted by Eric Covener on Nov 11 Severity: critical Affected versions: - Apache HTTP Server 2. 4. 55 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.