CVE-2026-119618 Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
A race in Apache HTTP Server mod_http2 header assignment can corrupt heap memory and allow remote code execution on servers using HTTP/2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-119618?
CVE-2026-119618 is a race condition vulnerability in Apache HTTP Server, published on 11 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Weakness: CWE-362
Which versions are affected by CVE-2026-119618?
Only installations with a non-default setting turned on are exposed.
How do I fix CVE-2026-119618?
Upgrade to a fixed version.
Upgrade, and make the check and the action one atomic step. More about Race condition.
Is CVE-2026-119618 being exploited?
There is no known exploitation of CVE-2026-119618 in the wild and no public exploit code.
Public exploit code: 9 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-119618, BELL-CVE-2026-119618, DEBIAN-CVE-2026-119618, ECHO-3cc1-0f38-0072, GHSA-hjhf-gpg9-qqfj, UBUNTU-CVE-2026-119618.