Posted by Eric Covener on Nov 11 Severity: critical Affected versions: - Apache HTTP Server 2.4.55 through 2.4.70 Description: Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/662
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Multiple vulnerabilities in C-Kermit
Posted by John Goerzen on Nov 01 A recent code quality sweep and audit uncovered multiple vulnerabilities in C-Kermit, some of which can lead to an RCE when working with…
CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday so let's have it here too. Copied from the advisory on the edk2 repo: Summary While a…
Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)
CVE-2026-111497 demonstrates how a single memory-corruption bug in a widely reused native decoder can affect applications far beyond the runtime where it was first…
CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability
CVE-2026-119618 is a critical race condition in mod_http2, the HTTP/2 module of the Apache HTTP Server. Improper synchronization of a shared resource in the module’s…
Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know
Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on…