Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know

A critical remote code execution (RCE) vulnerability, CVE-2026-119618, has been identified in the HTTP/2 module (mod_http2) of Apache HTTP Server. The flaw arises from a race condition in the assign_headers() function, which can lead to heap memory corruption when handling concurrent requests. Although no active exploitation has been observed, unauthenticated remote attackers could exploit this vulnerability to execute arbitrary code with web server privileges. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 and mod_h2 module versions 2.0.8 through 2.0.42.

AI-extracted · verify before operational use