Opens in a new tab
Proactive Security Virtual Summit: Proving Security in the Era of AI

Register →

CVE-2026-119618

Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

CVE-2026-119618 is a critical race condition in mod_http2, the HTTP/2 module of the Apache HTTP Server. Improper synchronization of a shared resource in the module’s assign_headers() function corrupts heap memory and can lead to remote code execution. An attacker needs no credentials, only the ability to reach the server over HTTP/2; the Red Hat advisory states that only servers with HTTP/2 enabled are affected, which means servers that negotiate h2 or h2c through the Apache Protocols directive. The Apache Software Foundation advisory rates the vulnerability critical and publishes no CVSS score; Red Hat rates it 9.8 (Critical) under CVSS v3.1. A public proof of concept exists, but no in-the-wild exploitation has been confirmed at the time of this writing.

Technical Details

mod_http2 serves many concurrent HTTP/2 streams over a single connection, with request processing spread across worker threads. In assign_headers(), a worker thread writes into memory owned by the connection thread through a shared, lock-free allocator, without adequate synchronization. The result is heap corruption — corruption of the memory the server allocates at runtime — which an attacker can steer toward executing code in the context of the web server process.

Weakness: CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization

Attack vector: Network. The attacker must reach a server that negotiates HTTP/2.

Authentication: None required.

User interaction: None required.

Impact: Heap corruption leading to remote code execution in the web server process, with high confidentiality, integrity and availability impact.

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, Critical)

Internet exposure is not required. Any Apache instance reachable from an untrusted network with HTTP/2 enabled is in scope, including internal reverse proxies and appliance management interfaces. Red Hat notes that the mod_http2 packages in Red Hat Enterprise Linux 9 and 10 allocate each HTTP/2 stream from a separate allocator, which substantially increases exploitation complexity, and rates those products Important rather than Critical.

Public exploitation research remains limited. A third-party proof of concept published on November 12, 2026 reproduces the heap corruption on 2.4.70 under memory and thread sanitizers and reports a clean result on 2.4.71; it does not demonstrate code execution, and its author is not affiliated with either team that reported the vulnerability. Red Hat’s advisory states that public research has demonstrated a reliable exploit against a default-configured server, but does not name or link that research. Neither Anthropic nor Google Cloud Vulnerability Research has published details of the original finding.

Stop Guessing, Start Proving

Attack path graph: an arrow runs from a NodeZero node to an exploited weakness, CVE-2026-119618 Apache mod_http2 RCE, marked with a Proof badge and a Host Compromise impact label
Schedule a demo

Affected Versions & Patch

Affected

  • Apache HTTP Server from 2.4.55 through 2.4.70
  • Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42
  • Not affected: mod_http2 versions before 2.0.8, which Red Hat states do not contain the affected code.

Fixed

  • Apache HTTP Server 2.4.71, released November 11, 2026
  • Standalone mod_h2 from GitHub: no fixed release is listed in the Apache advisory. Servers running it should move to a patched Apache HTTP Server.
  • Linux distributions ship the fix in their own mod_http2 or apache2 packages on separate timelines. Check the distribution’s advisory for the patched package version.

Mitigations

The Apache Software Foundation’s advisory publishes no workaround for CVE-2026-119618. Upgrading to 2.4.71 is the fix.

Because Red Hat states that only servers with HTTP/2 enabled are affected, disabling HTTP/2 removes exposure until the server can be patched. That means serving HTTP/1.1 only through the Apache Protocols directive:

Protocols http/1.1

This must be applied in the server-wide configuration and in every virtual host that sets its own Protocols value, and it takes effect on restart. It costs HTTP/2 support and its performance benefits for every client. It is a workaround, not a fix.

Timeline

  • October 26, 2026: Anthropic’s OSS Scanner reported the vulnerability to the Apache HTTP Server security team as ANT-2026-MAPKT6MZ.
  • November 3, 2026: Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported the vulnerability independently.
  • November 11, 2026: The Apache Software Foundation published its advisory and released Apache HTTP Server 2.4.71 containing the fix.
  • November 11, 2026: The CVE record for CVE-2026-119618 was published.
  • November 12, 2026: A third-party proof of concept reproducing the heap corruption under sanitizers was published.

References

Read about other CVEs

NodeZero® Platform

Implement a continuous find, fix, and verify loop with NodeZero

The NodeZero® platform empowers your organization to reduce your security risks by autonomously finding exploitable weaknesses in your network, giving you detailed guidance around how to priortize and fix them, and having you immediately verify that your fixes are effective.
Explore NodeZero

Recognized By