CVE-2026-119618: apache http_server, icing mod_http2

CVSS 8.1 (high) · published 2026-11-11

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Affected products (NVD): apache http_server, icing mod_http2

Fixed in (NVD): 2.4.71, 2.0.42

Weakness: CWE-362

Source: NVD CVE-2026-119618

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2026/11/11/13
• https://access.redhat.com/security/cve/cve-2026-119618
• https://bugs.gentoo.org/986161
• https://bugzilla.redhat.com/show_bug.cgi?id=2567318
• https://github.com/AlmaLinux/updates/issues/4252
• https://github.com/microsoft/azurelinux/pull/20165
• https://ubuntu.com/security/CVE-2026-119618
• https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.