Updated:
Status:
CVEs:
Fortra is actively researching a remote code execution vulnerability in Apache HTTP Server (CVE-2026-119618). Apache HTTP Server's mod_http2 module contains a synchronization vulnerability in the assign_headers() function during concurrent execution. An attacker could use this vulnerability to corrupt heap memory and execute arbitrary code. Successful exploitation of this vulnerability requires the attacker to win a race condition.
The primary recommendation is to upgrade Apache HTTP Server and the mod_h2 module to the fixed versions or later.
Who is affected?
The following Apache HTTP Server and mod_h2 module versions are affected:
- Apache HTTP Server versions 2.4.55 to 2.4.70
- mod_h2 module versions 2.0.8 to 2.0.42
What can I do?
Customers should apply the following upgrades:
- Upgrade Apache HTTP Server to version 2.4.71 or later
- Upgrade mod_h2 module to version 2.0.24 or later
For more information, refer to Public Blog.
How is Fortra helping me?
Fortra is actively researching this threat to build detection capabilities.
Updates
Fortra has kicked off the Emerging Threats process for this vulnerability. This article will be updated with new information about this vulnerability and related security coverage as it becomes available.
