Apache HTTP Server Hit by Critical HTTP/2 RCE Vulnerability

1 reports archived1 independent sourcesupdated 11/12/2026, 10:11:11

Synthesis & Latest Updates

1 Sources Cross-Validated

A critical race condition, CVE-2026-119618, has been disclosed in Apache HTTP Server's mod_http2 assign_headers() function, enabling heap corruption and unauthenticated remote code execution. No public exploit or in-the-wild activity is reported yet, and mitigation includes disabling h2/h2c or restricting to HTTP/1.1.

LATEST/A critical race condition, CVE-2026-119618, has been disclosed in Apache HTTP Server's mod_http2 assign_headers() function, enabling heap corruption and unauthenticated remote code execution. No public exploit or in-the-wild activity is reported yet, and mitigation includes disabling h2/h2c or restricting to HTTP/1.1.

Hourly heat curve

2 fully observed hours

Fewer than 3 fully observed hours; trend not plotted yet.

Coverage timeline

Total 1 reports · Latest first

Hacker News AIT2Nov 12, 10:11·78 pts
Apache HTTP Server Hit by Critical HTTP/2 RCE Vulnerability
- Flaw is a concurrency race in mod_http2's assign_headers() causing heap corruption
- Unauthenticated remote attackers can execute arbitrary commands as the web server process
- No public exploit yet; mitigate by removing h2/h2c or restricting to HTTP/1.1
View Related Reports & Analysis Original Source