{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mod_h2-2.0.8-through-2.0.42/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-119618"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache HTTP Server (2.4.55 through 2.4.70)","mod_h2 (2.0.8 through 2.0.42)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache Software Foundation"],"content_html":"\u003cp\u003eApache HTTP Server versions 2.4.55 through 2.4.70 contain a critical vulnerability in the mod_http2 module. A flaw in the assign_headers() function related to concurrent execution with improper synchronization can result in heap corruption and potential remote code execution (RCE). The vulnerability also affects mod_h2 releases from 2.0.8 through 2.0.42.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow for remote code execution on the server hosting the affected Apache HTTP Server software. The vulnerability is triggered during header processing, making it accessible to remote attackers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eAdministrators should immediately identify all systems running Apache HTTP Server versions 2.4.55 through 2.4.70. Prioritize patching to the latest stable version provided by the Apache Software Foundation to mitigate the risk of remote exploitation.\u003c/p\u003e\n","date_modified":"2026-11-11T17:48:03Z","date_published":"2026-11-11T17:48:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-httpd-rce-cve-2026-119618/","summary":"Apache HTTP Server versions 2.4.55 through 2.4.70 contain a heap corruption vulnerability in the mod_http2 module that may allow remote code execution due to improper synchronization during header assignment.","title":"Apache HTTP Server: mod_http2 heap corruption remote code execution (CVE-2026-119618)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-httpd-rce-cve-2026-119618/"}],"language":"en","title":"CraftedSignal Threat Feed - Mod_h2 (2.0.8 Through 2.0.42)","version":"https://jsonfeed.org/version/1.1"}