Apache HTTP Server HTTP/2 flaw CVE-2026-119618 allows unauthenticated RCE
Original title: Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know
Apache 2.4.55 through 2.4.70 is affected and 2.4.71 is fixed; Wiz reports no exploit or known attacks.
A race condition in mod_http2's assign_headers() can let a remote unauthenticated attacker corrupt heap memory and run code as the web server process. Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42 are affected. Anthropic and Google Cloud's Vulnerability Research Team independently found the flaw. Wiz says no exploit is available and no exploitation is known; it also says 64% of cloud environments have vulnerable resources and 51% have publicly exposed instances, without accounting for configuration.
Unconfirmed: A heading cites CVE-2026-111497 while the body describes CVE-2026-119618, and the mod_h2 fix is given as both 2.0.24 and newer and newer than 2.0.42.
- The flaw is a concurrent race while threads share resources in assign_headers().
- Patched Apache HTTP Server releases are 2.4.71 and newer.
- If patching must wait, disable HTTP/2 by removing h2 and h2c.
- Wiz's 64% and 51% figures do not account for configuration.
Impact: Unauthenticated remote code execution as the web server process
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache HTTP Server | From 2.4.55 through 2.4.70 | 2.4.71 and newer |
| GitHub mod_h2 | From 2.0.8 through 2.0.42 | 2.0.24 and newer |
- 1.Upgrade Apache HTTP Server to 2.4.71 or later.
- 2.Upgrade standalone mod_h2 builds to a version newer than 2.0.42.
- 3.If patching is delayed, disable HTTP/2 by removing h2 and h2c.
- CVEs
- CVE-2026-119618
- Vendors
- Apache Software Foundation
- Organizations
- AnthropicGoogle Cloud
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119618 | Race condition RCE in Apache HTTP Server mod_http2 | — | — | PoC |
From the original article
2 min read at wiz.io
Detect and mitigate CVE-2026-119618, a critical RCE vulnerability in Apache HTTP Server. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618. Immediate patching is advised.
By Merav Bar · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.