CVE-2026-119618
Published Nov 11 by Apache Software Foundation
Vulnerabilities · 11h ago
SecurityWeek’s November 11 report sharpened the dispute over Apache HTTP Server’s CVE-2026-119618: Red Hat says public research demonstrated a reliable exploit, while Wiz said no exploit or in-the-wild use had been reported. The flaw affects Apache 2.4.55–2.4.70 and standalone mod_h2 2.0.8–2.0.42, but only when HTTP/2 is enabled; Apache fixed it in 2.4.71.
Several server threads can reach shared HTTP/2 header data at the wrong time, corrupting memory. SecurityWeek says the public proof of concept it cites reproduces that corruption and crashes Apache, not remote code execution, so the public evidence does not settle whether the race can reliably become code execution.
Affected-version totals are a poor proxy for exposure: HTTP/2-disabled servers are outside the flaw’s reach, while HTTP/2 can be enabled per virtual host or supplied through standalone mod_h2. For organizations tracking only core Apache packages, configuration and module packaging leave the actual exposed set uncertain.
Published Nov 11 by Apache Software Foundation
8 sources covering this story
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).
Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.
Rilevate vulnerabilità in Apache HTTP Server
Aggiornamenti di sicurezza sanano 3 vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", in Apache HTTP Server.
Múltiples vulnerabilidades en Apache HTTP Server
Anthropic y los investigadores Anthony Weems y Simon Scannell, de Google Cloud Vulnerability Research
Kwetsbaarheid verholpen in Apache HTTP Server
Apache heeft een kwetsbaarheid verholpen in Apache HTTP Server, specifiek in de mod_http2 module (versies 2.4.55 tot 2.4.70) en mod_h2 module (versies 2.0.8 tot 2.0.42).
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
Apache HTTP Server 2.4.71 fixes a critical HTTP/2 flaw that could allow unauthenticated remote code execution on servers with HTTP/2 enabled.
FortiGuard Labs Threat Signals
Threat Signal Report | FortiGuard Labs
What is the Vulnerability?CVE-2026-119618 is a race condition (CWE-362) in Apache HTTP Server's mod_http2 module.
Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know | Wiz Blog
Detect and mitigate CVE-2026-119618, a critical RCE vulnerability in Apache HTTP Server.
Kwetsbaarheden verholpen in Siemens producten
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals SIMATIC en COMOS. De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie, wijziging of verwijdering van gegevens - Omzeilen van beveiligingsmaatregelen - Omzeilen van...
Rilevate vulnerabilità in prodotti Siemens
Rilevate alcune vulnerabilità, di cui 6 con gravità “alta”, in diversi prodotti Siemens. Tali vulnerabilità potrebbero consentire a un attaccante, in alcuni casi non autenticato, di eseguire codice arbitrario o di eludere i meccanismi di autenticazione sui sistemi interessati.
Part of the PlainSec briefing for 2026-11-13