CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Not scoredEPSS n/aPublished Updated Assigner: apache
Description
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
CWE-362
Status incidents that name it
- Akamai Customer Security Advisory: Remote code execution vulnerability in the Apache HTTP Server's HTTP/2 module· Minor · names this CVE
“…aware of the recently published remote code execution (RCE) vulnerability in the Apache HTTP Server's HTTP/2 module (CVE-2026-119618). Our subject matter experts (SMEs) are actively investigating its potential impact across our platform and…”
Affected vendors and products
Apache Software Foundation: Apache HTTP Server
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- httpd.apache.org/security/vulnerabilities_24.html (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)