A race condition in Apache HTTP Server lets attackers run arbitrary code — and 64% of cloud environments are exposed
Critical RCE Vulnerability in Apache HTTP Server
CVE-2026-119618 is a critical race condition in the assign_headers() function of Apache HTTP Server's mod_http2 module, independently found by Anthropic and Google Cloud's Vulnerability Research Team. A remote, unauthenticated attacker can corrupt heap memory and achieve arbitrary code execution with the web server's privileges. Wiz data shows 64% of cloud environments contain vulnerable resources and 51% have publicly exposed instances. No exploit exists yet. Patched in 2.4.71; disabling HTTP/2 is a stopgap.
According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618. Immediate patching is advised.
- jamesy0ung
Patch looks like https://github.com/apache/httpd/commit/5ed39287660daacd1233c...
- acidburnNSA
Appears to be the first issue ranked 'critical' since 2021. https://httpd.apache.org/security/vulnerabilities_24.html
- throooooo
I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
- rurcliped
For anyone temporarily shutting off an Apache httpd, there's one step that's sometimes missed: a cron job or systemd timer for certbot. This can restart httpd and leave it running. In other words, in some common uses of Let's Encrypt, standard instructions such as "systemctl disable --now apache2" aren't sufficient to keep httpd off.
- thehamkercat
> What is CVE-2026-111497?
> CVE-2026-119618 is a critical, high-severity vulnerability involving....
two CVEs? (111497 != 11968)
- account42
> in Apache HTTP Server’s HTTP/2 module (mod_http2)
I feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.
- neurostimulant
Chances are most Apache/PHP installations run mpm_prefork and aren’t affected by this.
- ankit9673
everybody new Vulnerability makes me think how we are not so good a writing secure code?.