Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-119618 EUVD-2026-123532GHSA-hjhf-gpg9-qqfj

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Published Nov 11, 2026 · Updated Nov 13, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache HTTP Server Package: apache2 Package: apache2 Package: apache2 Package: apache2 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache HTTP Server 2.4.55 – ≤ 2.4.70 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 No fix yet —
Debian 13 apache2 2.4.71-1~deb13u1 —
Debian 12 apache2 2.4.71-1~deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 apache2 2.4.68-1ubuntu6.2 USN-9090-1
Ubuntu 26.04 LTS apache2 2.4.66-2ubuntu2.8 USN-9090-1
Ubuntu 24.04 LTS apache2 2.4.58-1ubuntu8.19 USN-9090-1
Ubuntu 22.04 LTS apache2 2.4.52-1ubuntu4.27 USN-9090-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS apache2 2.4.41-4ubuntu3.23+esm11 USN-9090-1
Ubuntu Pro 18.04 LTS apache2 2.4.29-1ubuntu4.27+esm15 USN-9090-1
Ubuntu Pro 16.04 LTS apache2 2.4.18-2ubuntu3.17+esm24 USN-9090-1
Ubuntu Pro 14.04 LTS apache2 2.4.7-1ubuntu4.22+esm19 USN-9090-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 mod_http2 2.0.29-5.el10_3.1 RHSA-2026:98978
RHEL 9 mod_http2 2.0.26-7.el9_9.1 RHSA-2026:98981
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.2 EUS mod_http2 2.0.29-4.el10_2.3 RHSA-2026:98979
RHEL 10.0 EUS mod_http2 2.0.29-2.el10_0.3 RHSA-2026:98953
RHEL 9.8 EUS mod_http2 2.0.26-6.el9_8.3 RHSA-2026:98982
RHEL 9.6 EUS mod_http2 2.0.26-4.el9_6.3 RHSA-2026:98954
RHEL 9.4 E4S mod_http2 2.0.26-2.el9_4.4 RHSA-2026:98968
Red Hat Hardened Images 1 httpd +8 2.4.71-0.1.hum1 RHSA-2026:98998
Red Hat Hardened Images 1 mod_ssl +1 1:2.4.71-0.1.hum1 RHSA-2026:98998

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 mod_http2 2.0.29-5.el10_3.1 RLSA-2026:98978
Rocky Linux 9 mod_http2 2.0.26-7.el9_9.1 RLSA-2026:98981

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 apache2 2.4.71-r0 —
Alpine v3.23 apache2 2.4.71-r0 —
Alpine v3.22 apache2 2.4.71-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 httpd +8 2.4.71-1.amzn2023.0.1 ALAS2023-2026-3458
Amazon Linux 2023 mod_ssl +2 1:2.4.71-1.amzn2023.0.1 ALAS2023-2026-3458
Amazon Linux 2 httpd +7 2.4.71-1.amzn2.0.1 ALAS2-2026-4114
Amazon Linux 2 mod_ssl +2 1:2.4.71-1.amzn2.0.1 ALAS2-2026-4114

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache2 2.4.71-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 7 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 15

References