Apache Software Foundation

A critical race condition, CVE-2026-119618, has been disclosed in Apache HTTP Server's mod_http2 assign_headers() function, enabling heap corruption and unauthenticated remote code execution. No public exploit or in-the-wild activity is reported yet, and mitigation includes disabling h2/h2c or restricting to HTTP/1.1.