Vulnerability details
CVE-2026-119618
Apache Software Foundation Apache HTTP Server
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Not scored
Official description
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Related news
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| No score published yet. | |||
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.55 ≤ v ≤ 2.4.70 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-11
- Last updated
- 2026-11-11
- State
- Published
- Assigner (CNA)
- apache
- Kolun priority
- 0 · Low
Exploit prediction (EPSS)
No EPSS score has been published for this CVE yet.
Weaknesses (CWE)
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization