CVE-2026-119618
Published Nov 11, 2026
Last updated 6 hours ago
AI description
CVE-2026-119618 is a thread-safety flaw and race condition residing in the `mod_http2` module of the Apache HTTP Server, specifically within the `assign_headers()` function. The issue arises because HTTP/2 allows clients to send multiple concurrent requests over a single connection, which the server processes using multiple threads. Due to improper synchronization when handling these concurrent requests, a worker thread can write into memory owned by the connection thread through a shared, lock-free allocator, resulting in heap corruption. A remote, unauthenticated attacker can exploit this memory corruption to execute arbitrary commands on the server, potentially gaining full control over the server process. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70, as well as standalone `mod_h2` versions 2.0.8 through 2.0.42, provided that HTTP/2 is enabled. Servers configured to only serve HTTP/1.1 are not affected. The flaw was independently discovered and reported by Anthropic's OSS Scanner and Google Cloud Vulnerability Research in late October and early November of 2026. Apache addressed the issue on November 11, 2026, with the release of Apache HTTP Server version 2.4.71. Organizations are advised to upgrade to the patched version or temporarily disable HTTP/2 to mitigate the risk.
- Description
- Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
- Source
- security@apache.org
- NVD status
- Analyzed
- Products
- http_server, mod_http2
CVSS 3.1
- Type
- Secondary
- Base score
- 8.1
- Impact score
- 5.9
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@apache.org
- CWE-362
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
4
PHP vulnerability. PHP security. PHP patch. Three different RCEs are being talked about as if they're one thing. They're not. PHP2Shell — CVE-2026-109618 / CVE-2026-109619. A flaw in PHP itself. Patched Oct 21: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Apache CVE-2026-119618 — a
@PHPSiteAudit
13 Nov 2026
28 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Apache HTTP Server 2.4.71公開、HTTP/2のRCEなど脆弱性 3件(CVE-2026-119618,CVE-2026-106023,CVE-2026-109163)を修正 最大深刻度「Critical」、Anthropic・Google研究者が報告 https://t.co/7BqUjnZiSc #セキュリティ対策Lab #security #securitynews #
@securityLab_jp
12 Nov 2026
1653 Impressions
2 Retweets
15 Likes
2 Bookmarks
0 Replies
1 Quote
SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2 https://t.co/th2uZYzygy https://t.co/M2mJMCfCMz
@sans_isc
12 Nov 2026
1389 Impressions
1 Retweet
3 Likes
1 Bookmark
3 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EA2A33DB-23BB-4A27-9579-7EB1A977580C",
"versionEndExcluding": "2.4.71",
"versionStartIncluding": "2.4.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:icing:mod_http2:*:*:*:*:*:apache_httpd:*:*",
"matchCriteriaId": "C1F96999-0729-4CBE-80D1-F7AC6A24301E",
"versionEndExcluding": "2.0.42",
"versionStartIncluding": "2.0.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]