CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability
MentionsApache Software Foundation
CVE-2026-119618 is a critical race condition in Apache HTTP Server's mod_http2 that can lead to remote code execution without credentials. Fixed in 2.4.71. See affected versions, mitigations, and the NodeZero Rapid Response test.
Summary from Horizon3.ai.
Explained
The technology and terms in this story. Learn more
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
Podcast6 minSANS Internet Storm Center StormCast18h agoVulnerabilitiesEndpointAppSecCVE-2026-119618CVE-2026-121653