A critical race condition vulnerability in Apache HTTP Server's mod_http2 module allows unauthenticated remote attackers to achieve heap corruption and remote code execution on systems where HTTP/2 is enabled. Tracked as CVE-2026-119618 and rated Critical by the Apache Software Foundation, the flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Apache HTTP Server versions 2.4.55 through 2.4.70 are affected, along with standalone mod_h2 releases 2.0.8 through 2.0.42. The issue was fixed in Apache HTTP Server 2.4.71, released on 11 November 2026. Only configurations that negotiate HTTP/2 (h2 or h2c) via the Protocols directive are vulnerable; servers restricted to HTTP/1.1 are not exposed.
Vulnerability Details
CVE-2026-119618 is a concurrent execution using shared resource with improper synchronization flaw (CWE-362) located in the assign_headers() function within modules/http2/h2_request.c. The function clones a shared header table (req->headers) into the per-request headers_in structure, then subsequently writes to the shared table (for example, setting Content-Length to 0) without adequate synchronization.
The shared req->headers table is accessed by both the session/master thread (via h2_request_end_headers) and worker threads (via h2_c2 and related filter code). This creates a window for concurrent mutation of the APR table structure, resulting in heap corruption that can be leveraged for arbitrary code execution.
The vulnerability was independently reported by Anthropic's OSS Scanner (as ANT-2026-MAPKT6MZ) on 26 October 2026 and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research on 3 November 2026. Public technical analysis released shortly after disclosure demonstrated reliable exploitation against default-configured servers using the event MPM with mod_http2 enabled.
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Apache HTTP Server | 2.4.55 through 2.4.70 | 2.4.71 |
| mod_h2 (GitHub) | 2.0.8 through 2.0.42 | Pending standalone release |
Exposure and Risk Assessment
Apache HTTP Server remains one of the most widely deployed web servers. Cloud security research indicates that a substantial portion of environments contain resources running versions within the affected range. Because the attack requires only network access and no authentication or user interaction, internet-facing instances with HTTP/2 enabled represent the highest priority.
Successful exploitation grants the attacker control of the Apache worker process, enabling arbitrary command execution, access to sensitive data, and potential lateral movement within the hosting environment. The race condition nature means reliability depends on threading model and allocator behavior, but research has confirmed practical exploitation on common configurations.
Red Hat Product Security assessed the issue as Critical and noted that public research demonstrated reliable exploitation against default-configured systems. Severity ratings on certain enterprise distributions may be adjusted to Important where per-stream allocators increase exploitation complexity, but the underlying flaw remains present.
Mitigation and Remediation
Immediate actions:
- Upgrade Apache HTTP Server to version 2.4.71 or later, or apply the corresponding distribution security errata. Restart the httpd process after patching.
- If an immediate upgrade is not feasible, disable HTTP/2 by removing h2 and h2c from the Protocols directive (or equivalent configuration). This eliminates the vulnerable code path.
- Prioritize internet-facing systems and those with HTTP/2 actively enabled. Pure HTTP/1.1 configurations require no emergency action for this specific CVE.
- Verify package versions against vendor advisories, as backported fixes may carry different version strings.
Organizations running containerized or orchestrated Apache deployments should update base images and redeploy. Standalone mod_h2 users should monitor the upstream repository for a patched release.
Detection
A deterministic detection method exists that does not rely on version banners. An HTTP/2 request with a Content-Type header, no Content-Length, and the END_STREAM flag set on the HEADERS frame produces different behavior:
- Vulnerable versions (2.4.55-2.4.70) leave CONTENT_LENGTH unset in the request handler.
- Fixed versions (2.4.71+) preserve CONTENT_LENGTH as 0.
This oracle requires an endpoint that reflects or processes CONTENT_LENGTH (such as CGI, PHP, or certain proxy backends) and functions with ServerTokens Prod. Public scanners implementing this check are available.
Network monitoring can also identify anomalous HTTP/2 traffic patterns consistent with race-condition attempts, though the vulnerability itself does not produce unique network signatures beyond standard HTTP/2 request activity.
MITRE ATT&CK Mapping
| Tactic | Technique | ID | Relevance |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | Direct unauthenticated RCE against exposed Apache instances |
| Execution | Command and Scripting Interpreter | T1059 | Post-exploitation command execution via compromised worker process |
Sources
- Apache HTTP Server Project, Apache HTTP Server 2.4 vulnerabilities
- oss-security mailing list, CVE-2026-119618 advisory
- National Vulnerability Database, CVE-2026-119618
- Red Hat Customer Portal, CVE-2026-119618
- Wiz Research, Critical RCE Vulnerability in Apache HTTP Server