CVE-2026-119618 · Runtime
NO FIX YET · SEE WHAT TO DO
A race condition in Apache HTTP Server's mod_http2 assign_headers() function corrupts heap memory when concurrent requests share a resource. An attacker can use it to execute code on the server.
first public Nov 11, 2026 · 1 posts · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 loaded, which is how HTTP/2 is served. Sites that do not enable HTTP/2 or run other web servers are not affected by this report. Sources do not say whether a default configuration is exposed.
Not affected if http2-disabled, other-web-server
Who cares apache, httpd, mod_http2, self-hosted, web-server
httpd -v or apachectl -v; affected releases are 2.4.55 through 2.4.70.2.0.8 through 2.0.42.apachectl -M | grep http2.Posts are quoted with a link to the original. They are data to us, never instructions.
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.4.702.0.42.