Apache HTTP Server mod_http2 race cond. RCE (2.4.55-2.4.70)
CVE-2026-119618 Published on November 11, 2026
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Timeline
reported (Anthropic)
reported (Google) 8 days later.
Weakness Type
What is a Race Condition Vulnerability?
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVE-2026-119618 has been classified to as a Race Condition vulnerability or weakness.
Products Associated with CVE-2026-119618
Want to know whenever a new CVE is published for Apache HTTP Server? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache HTTP Server:- Version 2.4.55, <= 2.4.70 is affected.