Security · High impactFan score 43 · Tier B2 sources

Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know

The Brief · written from 2 sources

CVE-2026-119618 is a critical flaw in mod_http2's assign_headers() function in Apache HTTP Server, described as heap corruption leading to remote code execution.
The sources list affected versions as Apache HTTP Server 2.4.55 through 2.4.70.
Wiz reports that 64% of cloud environments have resources vulnerable to the flaw.

Why it matters

Heap corruption that can lead to remote code execution in a widely deployed web server means servers running affected versions could be fully compromised, so teams running Apache with mod_http2 should check their exposure and patch promptly.

Who’s affected

Teams running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2
Operators of cloud environments running Apache HTTP Server

What to do

Identify Apache HTTP Server instances in the 2.4.55 through 2.4.70 range that have mod_http2 enabled.
Patch affected servers immediately, as Wiz advises.

Apache HTTP Server 2.4.55 through 2.4.70
CVE-2026-119618
#apache
#http2
#security
#vulnerability
#rce
#web-server

Detect and mitigate CVE-2026-119618, a critical RCE vulnerability in Apache HTTP Server. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618. Immediate patching is advised.

Read the full story at wiz.io ↗