# CVE-2026-119618

Critical RCE in Apache HTTP Server mod_http2 via improper synchronization

- Page: https://www.vulneraibility.com/cve/CVE-2026-119618
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-362
- Published: 2026-11-11

## Affected versions

- Apache Software Foundation Apache HTTP Server: affected >= 2.4.55 and <= 2.4.70

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote code execution via a race condition in mod_http2 assign_headers(), enabling arbitrary code execution as the web server process.

## Action

Immediate action required

## Recommendation

Apply vendor fixes or upgrade Apache/mod_h2 immediately; restart and validate services.

## References

- [advisory] https://httpd.apache.org/security/vulnerabilities_24.html
- [other] http://www.openwall.com/lists/oss-security/2026/11/11/13
- [other] https://access.redhat.com/security/cve/cve-2026-119618
- [other] https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
- [other] https://github.com/microsoft/azurelinux/pull/20165
- [other] https://bugs.gentoo.org/986161
- [other] https://github.com/AlmaLinux/updates/issues/4252

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.