{"id":"CVE-2026-119618","kind":"vulnerability","aliases":["CVE-2026-119618"],"related":[],"title":"Apache HTTP Server: race in mod_http2 header handling allows remote code execution","description":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.","summary":"A race condition in Apache HTTP Server's mod_http2 assign_headers() function corrupts heap memory when concurrent requests share a resource. An attacker can use it to execute code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","httpd","mod_http2","runtime","self-hosted","web-server"],"not_affected_if":["http2-disabled","other-web-server"],"how_to_check":"- Check the Apache version with `httpd -v` or `apachectl -v`; affected releases are `2.4.55` through `2.4.70`.\n- If mod_h2 is installed from GitHub, check for versions `2.0.8` through `2.0.42`.\n- Confirm whether HTTP/2 is enabled with `apachectl -M | grep http2`.","fix":"- Apache HTTP Server: unknown fixed version in the sources; move past `2.4.70`.\n- mod_h2 from GitHub: unknown fixed version in the sources; move past `2.0.42`.","status":"open","published_at":"2026-11-11T15:17:15+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","triaged_at":"2026-11-11T15:29:56+00:00","updated_at":"2026-11-11T15:29:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T15:29:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apache HTTP Server: unknown fixed version in the sources; move past `2.4.70`.\n- mod_h2 from GitHub: unknown fixed version in the sources; move past `2.0.42`.","reach":"internet","title":"Apache HTTP Server: race in mod_http2 header handling allows remote code execution","impact":"high","summary":"A race condition in Apache HTTP Server's mod_http2 assign_headers() function corrupts heap memory when concurrent requests share a resource. An attacker can use it to execute code on the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache","httpd","mod_http2","self-hosted","web-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker runs code on the web server","analyst_note":"Find the fixed Apache HTTP Server and mod_h2 versions and the NVD or Apache advisory text on authentication and default config; the sources give only the affected ranges.","how_to_check":"- Check the Apache version with `httpd -v` or `apachectl -v`; affected releases are `2.4.55` through `2.4.70`.\n- If mod_h2 is installed from GitHub, check for versions `2.0.8` through `2.0.42`.\n- Confirm whether HTTP/2 is enabled with `apachectl -M | grep http2`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["http2-disabled","other-web-server"],"who_is_affected":"Servers running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 loaded, which is how HTTP/2 is served. Sites that do not enable HTTP/2 or run other web servers are not affected by this report. Sources do not say whether a default configuration is exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000807,"input_tokens":4619,"output_tokens":691,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119618':16A,19A '-2026':15A,18A '2.0.42':107C '2.0.8':105C '2.4.55':94C '2.4.70':96C 'affect':89C,97C 'allow':10A 'apach':1A,20B,35B,74C,90C 'assign':41B,81C 'attack':54B 'code':12A,60B 'concurr':48B,64C 'condit':33B 'corrupt':44B 'cve':14A,17A 'execut':13A,59B,65C 'function':43B 'github':103C 'h2':101C 'handl':9A 'header':8A,42B,82C 'heap':45B 'host':27B 'http':2A,36B,75C,91C 'http2':7A,23B,40B,79C 'httpd':21B 'improp':70C 'issu':88C 'lead':84C 'memori':46B 'mod':6A,22B,39B,78C,100C 'race':4A,32B 'rce':86C 'releas':98C 'remot':11A 'request':49B 'resourc':52B,68C 'runtim':24B 'self':26B 'self-host':25B 'server':3A,30B,37B,63B,76C,92C 'share':50B,67C 'synchron':71C 'use':56B,66C 'vulner':72C 'web':29B 'web-serv':28B","nicknames":[],"mitigations":[],"who_affected":"Servers running Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 loaded, which is how HTTP/2 is served. Sites that do not enable HTTP/2 or run other web servers are not affected by this report. Sources do not say whether a default configuration is exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","critical","httpd","modhttp2","runtime","selfhosted","webserver"],"campaign_type":null,"search_a":"'-119618':16A,19A '-2026':15A,18A 'allow':10A 'apach':1A 'code':12A 'cve':14A,17A 'execut':13A 'handl':9A 'header':8A 'http':2A 'http2':7A 'mod':6A 'race':4A 'remot':11A 'server':3A","search_b":"'apach':20B,35B 'assign':41B 'attack':54B 'code':60B 'concurr':48B 'condit':33B 'corrupt':44B 'execut':59B 'function':43B 'header':42B 'heap':45B 'host':27B 'http':36B 'http2':23B,40B 'httpd':21B 'memori':46B 'mod':22B,39B 'race':32B 'request':49B 'resourc':52B 'runtim':24B 'self':26B 'self-host':25B 'server':30B,37B,63B 'share':50B 'use':56B 'web':29B 'web-serv':28B","search_c":"'2.0.42':107C '2.0.8':105C '2.4.55':94C '2.4.70':96C 'affect':89C,97C 'apach':74C,90C 'assign':81C 'concurr':64C 'execut':65C 'github':103C 'h2':101C 'header':82C 'http':75C,91C 'http2':79C 'improp':70C 'issu':88C 'lead':84C 'mod':78C,100C 'rce':86C 'releas':98C 'resourc':68C 'server':76C,92C 'share':67C 'synchron':71C 'use':66C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:47:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119618","severity":null,"published_at":"2026-11-11T15:17:15+00:00","modified_at":"2026-11-11T15:17:15+00:00","first_seen_at":"2026-11-11T15:27:49+00:00","fetched_at":"2026-11-11T15:27:49+00:00","note":null}],"documents":[{"id":125877,"url":"https://news.ycombinator.com/item?id=50453368","title":"CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers","kind":"post","source":"hackernews","publisher":null,"text":"CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers\nhttps://httpd.apache.org/security/vulnerabilities_24.html\n\n2 points, 0 comments on Hacker News","published_at":"2026-11-11T13:47:26+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}