Critical Race Condition in Apache HTTP Server mod_http2 Can Lead to RCE

A critical synchronization vulnerability, CVE-2026-119618, has been identified in Apache HTTP Server's HTTP/2 module (mod_http2). The flaw is a race condition in the assign_headers() function that can let a remote, unauthenticated attacker corrupt heap memory and achieve arbitrary code execution. As of the blog's publication, no exploit is available and there are no reports of exploitation in the wild.

Discovery and technical details

The issue was independently discovered by Anthropic and Google Cloud's Vulnerability Research Team. It exists within assign_headers() in mod_http2, where improper synchronization during concurrent thread execution over shared resources can trigger heap corruption. That memory corruption can be leveraged for RCE on the hosting server, allowing unauthorized threat actors to execute arbitrary commands with the privileges of the web server process.

Risk to cloud environments

In cloud environments, a compromised Apache instance running containerized or virtualized workloads can serve as an entry point for lateral movement, potentially exposing adjacent microservices or cloud metadata endpoints. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances. The source notes that this does not take configuration into account.

Affected versions

The vulnerability affects deployments using HTTP/2 capabilities on Apache HTTP Server. Affected versions are Apache HTTP Server from 2.4.55 through 2.4.70, with 2.4.71 and newer listed as patched. For the GitHub mod_h2 module, versions from 2.0.8 through 2.0.42 are affected, with 2.0.24 and newer listed as patched.

Recommended actions

Security teams should upgrade Apache HTTP Server to version 2.4.71 or later, and update standalone mod_h2 builds from GitHub to a version newer than 2.0.42. If immediate patching is not possible, temporarily disable HTTP/2 support by editing a configuration file such as httpd.conf and restricting active protocols to HTTP/1.1, removing h2 and h2c references; the example sets Protocols http/1.1. Wiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment. The source also references Apache HTTP Server release notes.

Sources: wiz.io