Apache HTTP/2 RCE
What is the Vulnerability? CVE-2026-119618 is a race condition (CWE-362) in Apache HTTP Server's mod_http2 module. In assign_headers(), the module writes to a header table that is shared between the connection thread and worker threads without adequate synchronization. Concurrent access can corrupt the Apache child-process heap, which can be leveraged toward remote code execution in the worker process. Exploitation requires no authentication and no user interaction. The server only reaches the vulnerable code when HTTP/2 is enabled through the Protocols directive (h2 or h2c). The Apache default is HTTP/1.1, which is not exposed. Apache HTTP Server is one of the most widely deployed web serve
Read at FortiGuard Threat Signal reports
- Vendor
- Apache Software Foundation
- Product
- Apache HTTP Server
- Exposure class
- Web platform
Why it ranks 36 (Notable)
- Product class: web platform
- Covered by 4 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- FortiGuard Threat Signal reports (fortiguard.fortinet.com)
- CVE-2026-119618 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.