Security · High impactFan score 44 · Tier B3 sources

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

The Hacker News · 3h ago

The Brief · written from 3 sources

CVE-2026-119618 is a critical flaw in mod_http2's assign_headers() function in Apache HTTP Server, described as heap corruption leading to remote code execution.
The sources list affected versions as Apache HTTP Server 2.4.55 through 2.4.70.
Wiz reports that 64% of cloud environments have resources vulnerable to the flaw.

Why it matters

Heap corruption that can lead to remote code execution in a widely deployed web server means servers running affected versions could be fully compromised, so teams running Apache with mod_http2 should check their exposure and patch promptly.

Who’s affected

Teams running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2
Operators of cloud environments running Apache HTTP Server

What to do

Identify Apache HTTP Server instances in the 2.4.55 through 2.4.70 range that have mod_http2 enabled.
Patch affected servers immediately, as Wiz advises.

Apache HTTP Server 2.4.55 through 2.4.70
CVE-2026-119618
#apache
#http2
#security
#vulnerability
#rce
#web-server

A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are…

Read the full story at thehackernews.com ↗