Research

CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

CVE-2026-119618 is a critical race condition in Apache HTTP Server's mod_http2 that can lead to remote code execution without credentials. Fixed in 2.4.71. See affected versions, mitigations, and the NodeZero Rapid Response test.

Read at Horizon3.ai Attack Team

Vendor

Apache Software Foundation

Product

Apache HTTP Server

Fix

available

Exposure class

Web platform

• Horizon3.ai Attack Team (horizon3.ai)
• CVE-2026-119618 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 36
   Threat signal FortiGuard 4h ago

   Apache HTTP/2 RCE

   CVE-2026-119618 Apache Software Foundation
2. 46
   Ubuntu notice Ubuntu 5h ago

   Apache HTTP Server vulnerabilities

   CVE-2026-42528CVE-2026-109163CVE-2026-106023+2 more Canonical Apache Software Foundation
3. 29
   News SecurityWeek 11h ago

   Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

   CVE-2026-119618 Google Anthropic
4. 19
   Wiz Research Wiz 30h ago

   Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know

   CVE-2026-119618 Apache Software Foundation
5. 11
   CVE NVD 35h ago

   Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead…

   CVE-2026-119618 Apache Software Foundation