Apache HTTP Server Remote Code Execution Vulnerability (CVE-2026-119618)

A critical remote code execution vulnerability (with CVE-2026-119618) has been identified in the mod_http2 module of the Apache HTTP Server. The vulnerability enables unauthenticated remote code execution and could allow a remote attacker to corrupt heap memory, execute arbitrary commands, and take full control of the affected server process. System owners are strongly advised to review affected systems and take immediate mitigation measures to reduce potential risks.

Vulnerability

• Apache HTTP Server Remote Code Execution Vulnerability (CVE-2026-119618)
  • The flaw stems from improper synchronization of a shared resource (CWE-362) in the assign_headers() function within modules/http2/h2_request.c when processing concurrent HTTP/2 requests.
  • Multiple worker threads can access shared memory without proper coordination, allowing a worker thread to modify memory owned by the connection thread, resulting in heap corruption and unauthenticated remote code execution (RCE).

Severity Level

• Critical

Affected Systems

• Apache HTTP Server versions from 2.4.55 through 2.4.70
• mod_h2 from GitHub 2.0.8 through 2.0.42

Remediation

• Upgrade Apache HTTP Server to version 2.4.71 or later.
• Apply the latest patched httpd / mod_http2 packages from your Linux distribution vendor.
• Restart or reload the Apache HTTP Server service after applying the update to ensure the patched module is in use.
• Check the applicable vendor advisory or package changelog to confirm that the installed package contains the security fix for CVE-2026-119618.

Reference

• NVD: CVE-2026-119618
• HKCERT: Apache HTTP Server Multiple Vulnerabilities
• Ubuntu: CVE-2026-119618
• Red Hat: CVE-2026-119618
• Tenable: CVE-2026-119618
• Amazon Linux Security Center: CVE-2026-119618
• The Hacker News: Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

Published on: 13 Nov 2026