A critical synchronization vulnerability (CVE-2026-119618) has been identified in Apache HTTP Server’s HTTP/2 module (mod_http2). The flaw stems from a concurrent execution race condition within the assign_headers() function when handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution (RCE).
As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.
CVE-2026-119618 is a critical, high-severity vulnerability involving a race condition in the Apache HTTP Server, which was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team.
Specifically, the flaw exists within the assign_headers() function of the HTTP/2 module (mod_http2). Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption. This memory corruption can ultimately be leveraged to achieve RCE on the hosting server, allowing unauthorized threat actors to execute arbitrary commands with the privileges of the web server process.
In cloud environments, a compromised Apache instance running containerized or virtualized workloads can serve as an entry point for lateral movement, potentially exposing adjacent microservices or cloud metadata endpoints.
According to Wiz data 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances. Note that this does not take configuration into account.
The vulnerability affects deployments utilizing HTTP/2 capabilities on the Apache HTTP Server within the version ranges outlined in the table below:
| Vendor | Product | Affected Versions | Patched Versions |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | From 2.4.55 through 2.4.70 | 2.4.71 and newer |
| GitHub (Open Source) | mod_h2 module | From 2.0.8 through 2.0.42 | 2.0.24 and newer |
Security operations and engineering teams should execute the following remediation and mitigation steps:
Upgrade Apache HTTP Server: Update affected installations to Apache HTTP Server version2.4.71 or later. This release addresses the race condition inassign_headers() .
Update Standalone Modules: If managing standalone mod_h2 builds from GitHub, upgrade the module to a version newer than2.0.42 .
If immediate patching is not possible due to operational constraints, temporarily disable HTTP/2 support to eliminate the attack vector.
Wiz customers can use the pre-built query and advisory in the [Wiz Threat Center](https://app.wiz.io/boards/threat-center/wiz-adv-2026-191) to search for vulnerable instances in their environment.