CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Apache HTTP Server mod_http2 assign_headers() race, remote code execution (2.4.55 to 2.4.70, fixed in 2.4.71)

cve · CVE-2026-119618

Coverage
1
first 2026-11-12 → last 2026-11-12
Latest activity
2026-11-12
Apache httpd mod_http2 RCE: update to 2.4.71 or drop h2/h2c from Protocols; Debian stable has no fix yet
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
6
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-119618, newest first. Check the date before acting on an older one.

  • On every internet-facing Apache HTTP Server that loads mod_http2, update to 2.4.71 or to your distribution's fixed package (RHEL 9 mod_http2 2.0.26-7.el9_9.1, RHEL 10 mod_http2 2.0.29-5.el10_3.1) and restart it; where no fixed package exists yet, as on Debian bookworm and trixie, remove h2 and h2c from the Protocols directive until one does, because Red Hat reports an unauthenticated code-execution path and a public exploit, though it rates its RHEL 9 and 10 packages Important rather than Critical for their harder exploitation.
    2026-11-12CVE-2026-119618

Defender insights

What each entry about CVE-2026-119618 tells a defender to do, newest first.

2026-11-12NOTABLEApache httpd mod_http2 RCE: update to 2.4.71 or drop h2/h2c from Protocols; Debian stable has no fix yet

Exposure · detection

Story timeline

  1. 2026-11-12CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported
    trending-vulnerabilitiesApache httpd mod_http2 RCE: update to 2.4.71 or drop h2/h2c from Protocols; Debian stable has no fix yet

Hunting pivots

Affected products
Apache HTTP Server
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-12/cve-2026-119618-apache-httpd-mod-http2-assign-headers-rce · ATT&CK page ↗

Entries about Apache HTTP Server mod_http2 assign_headers() race, remote code execution (2.4.55 to 2.4.70, fixed in 2.4.71) (1)

2026-11-12 · view entry permalink →

NOTABLECVE-2026-119618NATOA2

CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported

Apache HTTP Server 2.4.71, released on 2026-11-11, fixes CVE-2026-119618, a race in mod_http2's assign_headers() that the project rates critical and says can lead to remote code execution, in versions 2.4.55 through 2.4.70 (Apache HTTP Server project, 2026-11-11). The project publishes no CVSS score; Red Hat scores it CVSS 3.1 9.8 and says it allows unauthenticated remote code execution, with a worker thread writing into memory owned by the connection thread through a shared lock-free allocator (Red Hat Product Security, 2026-11-11). Red Hat states that only servers with HTTP/2 (h2 or h2c) enabled through the Protocols directive are affected and that HTTP/1.1-only servers are not (Red Hat Product Security, 2026-11-11); the project's own page is silent on that prerequisite (Apache HTTP Server project, 2026-11-11).

On exploitation the sources differ. Wiz wrote that no exploit was available and no exploitation in the wild was reported at its publication (Wiz, 2026-11-11), while Red Hat says public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled, without linking it (Red Hat Product Security, 2026-11-11); no source reports attacks, and the project's advisory carries no exploitation or workaround statement (Apache HTTP Server project, 2026-11-11). Wiz advises disabling HTTP/2 temporarily as the interim measure (Wiz, 2026-11-11).

The upstream fix is 2.4.71. The project lists standalone mod_h2 releases from GitHub, 2.0.8 through 2.0.42, as affected and names no fixed standalone release (Apache HTTP Server project, 2026-11-11). Red Hat shipped mod_http2 errata for RHEL 9 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 (mod_http2-2.0.29-5.el10_3.1) on 2026-11-11, rates them Important (Red Hat, 2026-11-11; Red Hat, 2026-11-11), says the packages allocate each HTTP/2 stream from a separate allocator, which makes exploitation substantially more complex, and lists RHEL 8 and earlier as not affected (Red Hat Product Security, 2026-11-11); the Debian tracker lists bookworm, trixie and forky as vulnerable with only the unstable release fixed (Debian Security Tracker, 2026-11-12).

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.

Apache HTTP Server project 2026-11-11

Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.

It allows unauthenticated remote code execution, and public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled.

Red Hat Product Security 2026-11-11

As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.

Wiz 2026-11-11
vulnerability12 Nov 04:12Zmulti-sourceOpen finding →
Sources: Apache HTTP Server project · Red Hat Product Security · Wiz · Debian Security Tracker · Red Hat (RHSA-2026:98981, RHEL 9) · Red Hat (RHSA-2026:98978, RHEL 10)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • access.redhat.com3 (50%)
  • httpd.apache.org1 (17%)
  • security-tracker.debian.org1 (17%)
  • wiz.io1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)