Apache HTTP Server Patches Critical HTTP/2 Remote Code Execution Flaw

Summary

The Apache Software Foundation has released an Apache HTTP Server update that fixes CVE-2026-119618, a critical flaw in the HTTP/2 module that could let an unauthenticated attacker execute code remotely with the privileges of the web server process.

The Flaw

Apache describes the bug as "Concurrent Execution using Shared Resource with Improper Synchronization" in the assign_headers() function of mod_http2. The resulting race condition can corrupt heap memory.

Item	Detail
CVE	CVE-2026-119618
Affected	Apache HTTP Server 2.4.55 through 2.4.70
Also affected	Standalone `mod_h2` 2.0.8 through 2.0.42
Impact	Unauthenticated remote code execution
CVSS	No official score yet; Wiz rates it critical

The flaw was found by Anthropic's OSS Scanner and Google Cloud's Vulnerability Research teams. watchTowr confirmed the conditions under which servers are exposed.

Exposure

HTTP/2 is not enabled by default, so only servers that turned it on are affected. Wiz telemetry shows about 64% of cloud environments contain a vulnerable Apache resource, and roughly half of those are publicly exposed. That figure does not account for whether HTTP/2 is actually enabled.

Wiz knows of no public exploits or in-the-wild attacks so far, but warns that could change quickly.

Other Fixes in the Release

CVE-2026-106023: null pointer dereference in mod_md
CVE-2026-109163: low-severity data overwrite in mod_vhost_alias

What to Do

Upgrade to the latest Apache HTTP Server release, which contains the fix.
If you cannot patch immediately, disable HTTP/2 (remove h2 and h2c from the Protocols directive) until you can, as watchTowr advises.
Check for mod_http2 or standalone mod_h2 in your builds and container base images, not only on hosts you patch manually.

Source

BleepingComputer: Apache HTTP Server patches critical HTTP/2 remote code execution flaw