What is CVE-2026-119618?
CVE-2026-119618 is a race condition (CWE-362) in the assign_headers() function of mod_http2, the module that provides HTTP/2 support in Apache HTTP Server. Improper synchronization when the module writes request headers into shared stream data can corrupt heap memory in the server’s child process.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). The Apache HTTP Server project rates the issue critical in its own advisory but has not published a numeric score.
Exploitation is pre-authentication. An attacker needs only network access to a server that negotiates HTTP/2, either over TLS (h2) or cleartext (h2c), and no user interaction is required. The Apache advisory states that the flaw can lead to remote code execution.
The issue was reported independently by Anthropic and by Google Cloud Vulnerability Research. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and there are no public reports of exploitation in the wild. A third-party repository claims a proof of concept that reproduces the heap corruption, which has not been independently verified.
What assets are affected by CVE-2026-119618?
Apache HTTP Server versions 2.4.55 through 2.4.70 are affected, along with standalone mod_h2 releases 2.0.8 through 2.0.42. The vulnerable code path is reachable only when mod_http2 is loaded and HTTP/2 is enabled through the Protocols directive.
In practice, affected assets are public web servers, reverse proxies, and load-balancing tiers running httpd with HTTP/2 turned on for performance. HTTP/2 is common on TLS-terminating front ends, and many distribution and container images ship mod_http2 ready to enable. The affected range covers releases from early 2023 onward, so it includes most httpd builds deployed or updated in the past three years.
These servers are internet-facing by design, and they often sit in front of applications owned by other teams. That separation makes the web tier easy to overlook in patch cycles, particularly where httpd is bundled inside appliances, vendor products, or base images that are rebuilt infrequently.
What does our data show about exposure patterns?
Exposure in this set is led by Industrials at 18.9% of observed assets, with Information Technology contributing 16.9% and Communication Services 14.9%. The remaining share is spread across Health Care, Consumer Discretionary, Financials, and several smaller sectors, with no single sector dominating.
Industrials in this set is weighted toward commercial services, professional services, and transport. These organizations tend to run distributed web estates across business units, partner portals, and acquired properties, often on long-lived Linux hosts where httpd was installed once and left in place. Information Technology and Communication Services run large fleets of customer-facing web front ends, where HTTP/2 is routinely enabled for performance.
The broad, flat distribution points to httpd’s ubiquity rather than a sector-specific weakness. Most of the set was identified by service fingerprint rather than by confirmed version detection, and HTTP/2 enablement cannot always be confirmed from the outside. Where a version string was observed, it fell inside the affected range in nearly all cases. The underlying risk driver is visibility: knowing which web servers exist, which versions they run, and whether HTTP/2 is turned on.
Are fixes available?
Yes. The Apache HTTP Server project fixed CVE-2026-119618 in version 2.4.71, released on November 11, 2026. Upgrading to 2.4.71 or later removes the vulnerable code path.
For standalone mod_h2 deployments, public sources disagree on the first fixed release, and an upstream mod_h2 release containing the fix could not be confirmed at the time of writing. Distribution packages are also uneven. Debian has published a fixed package in its unstable branch, while its stable releases were still listed as vulnerable, and Ubuntu and Red Hat had not yet published status.
Defenders running httpd from operating system packages, appliances, or vendor-bundled builds should confirm patch availability directly with their vendor rather than assuming the upstream fix has been backported.
Are there any other recommended actions to take?
Until patching is confirmed, defenders should:
- Inventory all internet-facing httpd instances and record their running versions
- Identify servers with h2 or h2c listed in the Protocols directive
- Remove h2 and h2c from Protocols where HTTP/2 is not required
- Disable cleartext h2c on any server exposed to untrusted networks
- Monitor error logs for repeated child process crashes or segmentation faults
- Audit base images and appliances for bundled httpd builds in the affected range
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-119618 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
