The vulnerability exists in the mod_http2 module due to improper synchronization during concurrent execution in the assign_headers() function. Successful exploitation could result in heap memory corruption, potentially allowing attackers to execute arbitrary code on affected systems. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70, including standalone mod_h2 versions 2.0.8 through 2.0.42. Organizations running affected versions are advised to prioritize remediation to minimize potential security risks.
Severity: Critical
Affected Product: Apache HTTP Server
Affected Versions: 2.4.55 through 2.4.70
Fixed Version: 2.4.71
Advisory Date: November 11, 2026
CVE ID | Severity | Vulnerability | Affected Versions |
CVE-2026-119618 | Critical | Heap corruption and remote code execution in mod_http2 | 2.4.55–2.4.70 |
Along with the critical RCE vulnerability, Apache HTTP Server 2.4.71 addresses two additional security vulnerabilities.
CVE ID | Severity | Vulnerability | Affected Versions |
CVE-2026-106023 | Important | NULL pointer dereference in mod_md, potentially causing child process crashes | 2.4.30–2.4.70 |
CVE-2026-109163 | Low | Stack-based buffer overwrite in mod_vhost_alias | 2.4.69–2.4.70 |
Apache has addressed all three vulnerabilities in Apache HTTP Server 2.4.71, released on November 11, 2026.
Organizations are recommended to upgrade affected installations to version 2.4.71 or apply the appropriate security updates provided by their operating system vendors.
It is also recommended to validate the updates in a test environment before deploying them to production systems to ensure application compatibility and minimize disruptions.
Apache Official Security Advisory:
https://httpd.apache.org/security/vulnerabilities_24.html
Critical Vulnerability Details:
https://www.cve.org/CVERecord?id=CVE-2026-119618