Apache HTTP Server: mod_http2 heap corruption remote code execution (CVE-2026-119618)
Apache HTTP Server versions 2.4.55 through 2.4.70 contain a heap corruption vulnerability in the mod_http2 module that may allow remote code execution due to improper synchronization during header assignment.
CVE search metadata
CVE search record: CVE-2026-119618. KEV: no. Product: Apache HTTP Server (2.4.55 through 2.4.70), mod_h2 (2.0.8 through 2.0.42). Brief: Apache HTTP Server: mod_http2 heap corruption remote code execution (CVE-2026-119618). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-httpd-rce-cve-2026-119618/
Triage facts
Revision 1- Applicability
- Apache HTTP Server (2.4.55 through 2.4.70), mod_h2 (2.0.8 through 2.0.42)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 17:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
Apache HTTP Server versions 2.4.55 through 2.4.70 contain a critical vulnerability in the mod_http2 module. A flaw in the assign_headers() function related to concurrent execution with improper synchronization can result in heap corruption and potential remote code execution (RCE). The vulnerability also affects mod_h2 releases from 2.0.8 through 2.0.42.
Impact
Successful exploitation may allow for remote code execution on the server hosting the affected Apache HTTP Server software. The vulnerability is triggered during header processing, making it accessible to remote attackers.
Recommendation
Administrators should immediately identify all systems running Apache HTTP Server versions 2.4.55 through 2.4.70. Prioritize patching to the latest stable version provided by the Apache Software Foundation to mitigate the risk of remote exploitation.
Immediate actions
Inventory all public-facing servers running Apache HTTP Server 2.4.55-2.4.70
Apply patches for CVE-2026-119618 as soon as available from the vendor
Threat Hunt
Investigate web server access logs for anomalous, malformed, or unusually large HTTP/2 header sequences targeting the server
Data: Web server access logs (HTTP/2 traffic)
Mitigations
Patch Apache HTTP Server to version > 2.4.70
CVE-2026-119618