Critical vulnerability
Critical remote code execution in Apache HTTP Server (CVE-2026-119618)
Remote code execution in Apache HTTP Server · Servers and applications
CVE-2026-119618
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
- Severity
- Critical
- Published
- 11 Nov 2026
- Weakness
- Race condition (CWE-362)
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
| Software | Affected versions |
|---|---|
| Apache HTTP ServerServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-119618
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.