CVE-2026-119618

Published: Nov 11, 2026Modified: Nov 12, 2026

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Related CWEs

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (8)

https://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/11/11/13

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/cve-2026-119618

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.gentoo.org/986161

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/AlmaLinux/updates/issues/4252

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/microsoft/azurelinux/pull/20165

Source: af854a3a-2127-422b-91ae-364da2661108

https://ubuntu.com/security/CVE-2026-119618

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.