Vulnerability

CVE-2026-119618

Not in KEVNo confirmed exploitation in CISA's catalog yet

What is it?

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Official description from NVD.

What happened

Apache HTTP Server's mod_http2 module contains a critical remote code execution vulnerability affecting versions 2.4.55 through 2.4.70. Unauthenticated attackers can execute arbitrary code on servers with HTTP/2 enabled. The flaw is fixed in version 2.4.71 released November 11. Administrators running affected versions should upgrade immediately to patch the vulnerability.

From the Intel60 brief of Nov 12, 2026. AI-written summary: check the sources before acting.

Intel60 briefs

CriticalApache HTTP/2 module critical RCE flaw CVE-2026-119618Nov 12, 2026

Official records

NVDScores, affected versions and references
CVE.orgThe official CVE record