Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know

A critical race-condition vulnerability tracked as CVE-2026-119618 in Apache HTTP Server's mod_http2 module allows a remote, unauthenticated attacker to corrupt heap memory in the assign_headers() function and achieve arbitrary code execution, with no exploit available and no in-the-wild exploitation reported as of publication. The flaw, independently discovered by Anthropic and Google Cloud's Vulnerability Research Team, affects Apache HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42; Wiz data cited in the advisory found 64% of cloud environments have vulnerable resources and 51% have publicly exposed instances. Administrators are advised to upgrade to Apache HTTP Server 2.4.71 or later, update standalone mod_h2 builds past 2.0.42, or disable HTTP/2 if patching is not immediately possible.

A critical synchronization vulnerability CVE-2026-119618 has been identified in Apache HTTP Server’s HTTP/2 module mod http2 . The flaw stems from a concurrent execution race condition within the assign headers function when handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution RCE . As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild. CVE-2026-119618 is a critical, high-severity vulnerability involving a race condition in the Apache HTTP Server, which was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team. Specifically, the flaw exists within the assign headers function of the HTTP/2 module mod http2 . Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption. This memory corruption can ultimately be leveraged to achieve RCE on the hosting server, allowing unauthorized threat actors to execute arbitrary commands with the privileges of the web server process. In cloud environments, a compromised Apache instance running containerized or virtualized workloads can serve as an entry point for lateral movement, potentially exposing adjacent microservices or cloud metadata endpoints. According to Wiz data 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances. Note that this does not take configuration into account. The vulnerability affects deployments utilizing HTTP/2 capabilities on the Apache HTTP Server within the version ranges outlined in the table below: | Vendor | Product | Affected Versions | Patched Versions | |---|---|---|---| | Apache Software Foundation | Apache HTTP Server | From 2.4.55 through 2.4.70 | 2.4.71 and newer | | GitHub Open Source | mod h2 module | From 2.0.8 through 2.0.42 | 2.0.24 and newer | Security operations and engineering teams should execute the following remediation and mitigation steps: Upgrade Apache HTTP Server: Update affected installations to Apache HTTP Server version 2.4.71 or later. This release addresses the race condition in assign headers . Update Standalone Modules: If managing standalone mod h2 builds from GitHub, upgrade the module to a version newer than 2.0.42 . If immediate patching is not possible due to operational constraints, temporarily disable HTTP/2 support to eliminate the attack vector. Wiz customers can use the pre-built query and advisory in the Wiz Threat Center https://app.wiz.io/boards/threat-center/wiz-adv-2026-191 to search for vulnerable instances in their environment.