---
id: "CVE-2026-119618"
page: "https://infrastack.ai/live/CVE-2026-119618"
kind: "vulnerability"
aliases: ["CVE-2026-119618"]
title: "Apache HTTP Server: race in mod_http2 header handling allows remote code execution"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache", "httpd", "mod_http2", "runtime", "self-hosted", "web-server"]
not_affected_if: ["http2-disabled", "other-web-server"]
published_at: "2026-11-11T15:17:15+00:00"
first_seen_at: "2026-11-11T15:27:49+00:00"
updated_at: "2026-11-11T15:29:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119618", "first_seen_at": "2026-11-11T15:27:49+00:00"}]
exploit_sources: []
---

# Apache HTTP Server: race in mod_http2 header handling allows remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-119618 (this .md is for agents)

A race condition in Apache HTTP Server's mod_http2 assign_headers() function corrupts heap memory when concurrent requests share a resource. An attacker can use it to execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache version with `httpd -v` or `apachectl -v`; affected releases are `2.4.55` through `2.4.70`.
- If mod_h2 is installed from GitHub, check for versions `2.0.8` through `2.0.42`.
- Confirm whether HTTP/2 is enabled with `apachectl -M | grep http2`.

## Fix

- Apache HTTP Server: unknown fixed version in the sources; move past `2.4.70`.
- mod_h2 from GitHub: unknown fixed version in the sources; move past `2.0.42`.

## Timeline

- 2026-11-11T15:27:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119618

## Documents

- [discussion] CVE-2026-119618 (critical): mod_HTTP2: heap corruption and RCE in assign_headers https://news.ycombinator.com/item?id=50453368

## From the sources

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_