Security · High impactFan score 43 · Tier B
CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
The Brief
- CVE-2026-119618 is a heap corruption and remote code execution issue in mod_http2's assign_headers() in Apache HTTP Server.
- The flaw is a concurrency bug: a shared resource is accessed with improper synchronization.
- Affected versions are Apache HTTP Server 2.4.55 through 2.4.70, and the advisory rates it critical.
Why it matters
Servers running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 may be exposed to remote code execution, so affected operators should assess their exposure.
Who’s affected
- Teams running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 enabled
What to do
- Check whether your Apache HTTP Server version falls within 2.4.55 through 2.4.70 and whether mod_http2 is enabled.
- Apache HTTP Server 2.4.55 through 2.4.70
- CVE-2026-119618
- #apache
- #http2
- #vulnerability
- #remote-code-execution
- #memory-corruption
- #web-server
Posted by Eric Covener on Nov 11 Severity: critical Affected versions: - Apache HTTP Server 2.4.55 through 2.4.70 Description: Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can…
Timeline
Vulnerability disclosed on the oss-sec mailing list
Open Source Security
CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers