CVE
CVE-2026-119618
Apache Software Foundation · Apache HTTP Server
- First Reported
- Nov 12, 2026
- Latest Reported
- Nov 12, 2026
CVE Enrichment
- CISA KEV
- Not listed
Description
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Technical Details
- CNA / NVD Source
- [email protected]
- Published
- 11-Nov-2026 22:17
- Last Modified
- 12-Nov-2026 02:17
- CWE
- CWE-362
CNA Products / Version Status
- Apache Software Foundation · Apache HTTP Server
Source: CNA · [email protected]
Default status: unaffected
2.4.55 ≤ version ≤ 2.4.70 — affected (semver)
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Apache HTTP/2 Flaw Could Allow Unauthenticated Remote Code Execution
People (2)
MITRE ATT&CK (1)
Vendors (2)
Products (4)
Tools (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.