CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

Reported by Horizon3.ai (Horizon3)

Summary by Cyber Security News12 Nov 2026, 21:17 CET

About this summary. This is a short excerpt from the description that Horizon3.ai published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-119618/

CVE-2026-119618 is a critical race condition in mod_http2, the HTTP/2 module of the Apache HTTP Server. Improper synchronization of a shared resource in the module’s assign_headers() function corrupts heap memory and can lead to remote code execution. An attacker needs no credentials, only the ability to reach the server over HTTP/2; the Red Hat advisory states that only servers with HTTP/2… Source

Read the full article at Horizon3.ai →

Source attribution: headline and facts are from Horizon3.ai (horizon3.ai). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know

CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition

Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know

CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers