Skip to content
Sign in
CVE-2026-119618Not scored

CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Apache Software Foundation · Apache HTTP Server

No distribution fix yet for Debian 12/13 · Affected: Apache Software Foundation Apache HTTP Server · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check

No EPSS score yet. The score appears once FIRST publishes it.

Not scored yet. NVD has not published a CVSS score.

DescriptionNVD

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

What changed

Debian status tracked since 11 Nov 2026.

  1. Debian’s tracker lists Debian 12 as affected, with no fix released Debian
  2. Debian’s tracker lists Debian 13 as affected, with no fix released Debian

Coverage2 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 11 Nov.

Full timeline
Developinglatest 7 hours ago2 articles2 outlets
11 Nov · SecurityOnline firstNow
  • Wed 11 Nov, 16:01 UTC. SecurityOnline, first report. Apache fixes HTTP/2 flaw that could enable remote code execution.
  • Thu 12 Nov, 06:00 UTC. The Hacker News, its first report on the story. Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution.
All coveragerunning total2SecurityOnl…1The Hacker…112 NovNow
  • First report
  • Article
  • Running total
Show as table
2 articles about CVE-2026-119618 from 2 outlets
Published (UTC)OutletHeadline
11 Nov 16:01SecurityOnlineApache fixes HTTP/2 flaw that could enable remote code execution
12 Nov 06:00The Hacker NewsApache fixes HTTP/2 flaw enabling unauthenticated remote code execution
  1. Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution
    The Hacker News
  2. Apache fixes HTTP/2 flaw that could enable remote code execution
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in