# CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/662) · 2026-11-11 · Security
Page: https://themorning.dev/story/cve-2026-119618-apache-http-server-mod-http2-heap-corruption-and-rce-in-assign-h-1dfd9abb8fbcdbcc
Kind: security · Impact: high

## In brief

- CVE-2026-119618 is a heap corruption and remote code execution issue in mod_http2's assign_headers() in Apache HTTP Server.
- The flaw is a concurrency bug: a shared resource is accessed with improper synchronization.
- Affected versions are Apache HTTP Server 2.4.55 through 2.4.70, and the advisory rates it critical.

## Why it matters

Servers running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 may be exposed to remote code execution, so affected operators should assess their exposure.

## What to do

- Check whether your Apache HTTP Server version falls within 2.4.55 through 2.4.70 and whether mod_http2 is enabled.

## Versions

- Apache HTTP Server 2.4.55 through 2.4.70

## CVEs

- CVE-2026-119618

## Timeline

- 2026-11-11: Vulnerability disclosed on the oss-sec mailing list

## Coverage

- [CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers](https://seclists.org/oss-sec/2026/q4/662) — Open Source Security, 2026-11-11

Tags: apache, http2, vulnerability, remote-code-execution, memory-corruption, web-server

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev