Vulnerability · critical
Apache HTTP Server mod_http2 heap corruption and RCE (CVE-2026-119618)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Popular tool · Full takeover
What to do
- Check whether your Apache HTTP Server version falls within 2.4.55 through 2.4.70 and whether mod_http2 is enabled.
The Brief
- CVE-2026-119618 is a heap corruption and remote code execution issue in mod_http2's assign_headers() in Apache HTTP Server.
- The flaw is a concurrency bug: a shared resource is accessed with improper synchronization.
- Affected versions are Apache HTTP Server 2.4.55 through 2.4.70, and the advisory rates it critical.
Why it matters
Servers running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 may be exposed to remote code execution, so affected operators should assess their exposure.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Apache HTTP Server is a web server that developers and ops teams run; judgment from general knowledge. |
| No | Core infrastructure | Apache HTTP Server is a single widely used product, not foundational software like OpenSSH or glibc. |
| Yes | Popular tool | Apache HTTP Server is one of the most widely deployed web servers; judgment from general knowledge. |
| No | Exploited in the wild | Open Source Security (2026-11-11) post reports severity and RCE only; it does not mention observed attacks. |
| No | Public exploit | Open Source Security (2026-11-11) post gives an advisory only; no exploit code or PoC is mentioned. |
| No | Remote, no login | Open Source Security (2026-11-11) post does not state that the attack needs no credentials; the description is truncated. |
| Yes | Full takeover | Open Source Security (2026-11-11) post title says heap corruption and RCE in assign_headers. |
| No | Secrets exposed | Open Source Security (2026-11-11) post does not mention any stolen or exposed data. |
| No | Supply chain | Open Source Security (2026-11-11) post describes a normal vulnerability in legitimate code, not malicious code shipping. |
| No | No fix yet | Open Source Security (2026-11-11) post does not state whether a fixed version is available. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-362
Timeline
Vulnerability disclosed on the oss-sec mailing list
Open Source Security
CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Source
CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers ↗ Open Source Security · 1h ago
First seen · 1 source · Full story page · How tiers are decided