UpHeron
All vulnerabilities

Servers and applications

CVE-2026-119618

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Severity
Critical
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Race condition (CWE-362)
Sources
CVE Program

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

From the CVE Program.

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cna:apache software foundation|apache http server
  • From 2.4.55 up to 2.4.70

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-119618