CVE-2026-119618
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
| CWE | CWE-362 |
| Vendor | apache software foundation |
| Product | apache http server |
| Published | Nov 11, 2026 |
| Last Updated | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache http server
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache http server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache HTTP Server
2.4.55 ≤ 2.4.70
References
httpd.apache.org: https://httpd.apache.org/security/vulnerabilities_24.html openwall.com: http://www.openwall.com/lists/oss-security/2026/11/11/13 access.redhat.com: https://access.redhat.com/security/cve/cve-2026-119618 wiz.io: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability github.com: https://github.com/microsoft/azurelinux/pull/20165 bugs.gentoo.org: https://bugs.gentoo.org/986161 github.com: https://github.com/AlmaLinux/updates/issues/4252
Credits
Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research