CVEs / CVE-2026-119618
CVE-2026-119618: Apache Software Foundation Apache HTTP Server vulnerability
- EPSS 1.32% chance of exploitation in the next 30 days, higher than 71% of CVEs (14 Nov 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-119618
Description
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Apache Software Foundation Apache HTTP Server | from 2.4.55, up to and including 2.4.70 | — |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 13 Nov 2026.
Severity
| Weakness | CWE-362 |
|---|
On the Stackurity blog
References
- CVE-2026-119618 on NVD
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://www.openwall.com/lists/oss-security/2026/11/11/13
- https://access.redhat.com/security/cve/cve-2026-119618
- https://bugs.gentoo.org/986161
- https://github.com/AlmaLinux/updates/issues/4252
- https://github.com/microsoft/azurelinux/pull/20165
- https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.