CVE-2026-119618: What We Know About the Critical Apache mod

CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition

Reported by Praetorian (Michelle Rhodes)

Summary by Cyber Security News12 Nov 2026, 15:16 CET

About this summary. This is a short excerpt from the description that Praetorian published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.praetorian.com/blog/cve-2026-119618/

Critical Apache HTTP Server Vulnerability: What Defenders Need to Know On November 11, 2026, the Apache Software Foundation disclosed CVE-2026-119618, a critical race condition in mod_http2, the module that provides HTTP/2 support in Apache HTTP Server. According to Apache’s advisory, the flaw can corrupt heap memory and may lead to remote code execution on the server. It affects Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 releases 2.0.8 through 2.0.42.

Read the full article at Praetorian →

Source attribution: headline and facts are from Praetorian (praetorian.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know

CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

Red Hat security advisory (AV26-1136)

OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing