Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Apache HTTP Server mod_http2 race can yield remote code execution

Original title: CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

Horizon3.aiby Horizon3 ()3 min read1
Read at horizon3.ai
Part of a story covered by 14 sourcesApache 2.4.71 fixes critical mod_http2 race; exploit claims conflictMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Versions 2.4.55 through 2.4.70 are fixed in 2.4.71; a public PoC shows heap corruption, not code execution.

CVE-2026-119618 is a critical race in Apache HTTP Server’s mod_http2 assign_headers() function. An unauthenticated attacker who can reach a server negotiating HTTP/2 can corrupt heap memory and may achieve remote code execution in the web server process. Apache rates it critical without a CVSS score; Red Hat scores it 9.8. Apache HTTP Server 2.4.71, released November 11, 2026, contains the fix. No in-the-wild exploitation is confirmed.

Unconfirmed: Red Hat says unnamed public research showed a reliable exploit; the published PoC does not demonstrate code execution.

Key facts
  • Affected Apache HTTP Server releases are 2.4.55 through 2.4.70.
  • GitHub mod_h2 2.0.8 through 2.0.42 has no listed fixed release.
  • A November 12 PoC reproduces heap corruption on 2.4.70 under sanitizers.
  • Only servers with HTTP/2 enabled are affected, per Red Hat.
  • RHEL 9 and 10 mod_http2 uses separate allocators, raising exploit complexity.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated remote code execution in the web server process

ProductAffectedFixed in
Apache Software Foundation Apache HTTP Server2.4.55 through 2.4.702.4.71
Apache Software Foundation mod_h22.0.8 through 2.0.42—
What to do
  1. 1.Upgrade Apache HTTP Server to 2.4.71.
  2. 2.Disable HTTP/2 with Protocols http/1.1 until the server is patched.
  3. 3.Check the distribution advisory for the patched mod_http2 or apache2 package.
Analyze CVE-2026-119618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-119618
ATT&CK
T1190 Exploit Public-Facing Application
Tags
apachehttp2mod-http2race-conditionremote-code-execution
Vendors
Apache Software FoundationRed Hat
Products
Apache HTTP Servermod_http2mod_h2
Organizations
AnthropicGoogle Cloud Vulnerability Research

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-119618
Race condition RCE in Apache HTTP Server mod_http2
8.1<1%PoC ×9

From the original article

3 min read at horizon3.ai

CVE-2026-119618 is a critical race condition in Apache HTTP Server's mod_http2 that can lead to remote code execution without credentials. Fixed in 2. 4.

Horizon3.ai

By Horizon3 · horizon3.ai

Read the full article at Horizon3.ai

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.