Vulnerability in Apache Software Foundation HTTP Server

CVE-2026-119618

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Vulnerability class: Race Condition

Published 2026-11-11 · last modified 2026-11-12.

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Apache Software Foundation HTTP Server

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

Public exploits and proof-of-concept code

6 public repositories with exploit or proof-of-concept code for this CVE:

googlesky/CVE-2026-119618 (3 stars, last pushed 2026-11-12): Apache httpd mod_http2 (2.4.55-2.4.70) races on the connection allocator when assign_headers() writes the synthesised Content-Length: 0 into the shared stream table, corrupting the child heap. Contai…
jeffschafer/Apache-HTTP2-RCE-HEAP-CORRUPTION-CVE-2026-119618-STAND-ALONE-SCANNER (last pushed 2026-11-12): Independent community CLI scanners for Apache mod_http2 CVE-2026-119618 on Windows, Linux and macOS. Not HCL-supported.
geovanidps/cve-2026-119618-Apache (last pushed 2026-11-12): cve-2026-119618
jeffschafer/Bigfix-Apache-HTTP2-Vulnerability-Scanner-CVE-2026-119618 (last pushed 2026-11-12): Passive BigFix Apache mod_http2 CVE-2026-119618 assessment pilot; archived review snapshot.
suominen/CVE-2026-119618 (last pushed 2026-11-12)
foxcornlab/apache-httpd-scanner (last pushed 2026-11-12): Detection-only triage for Apache HTTP Server 2.4.71 batch: CVE-2026-119618 (mod_http2 RCE, CVSS 9.8), CVE-2026-106023, CVE-2026-109163. Grades httpd versions, catches the distro-backport and mod_h2 t…

References

This CVE has public exploit evidence. See the latest CVEs with public exploits.