CVE-2026-119618
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headerstitle from the CVE record
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
- CVSS
- Unavailable
- EPSS (exploit probability)
- Unavailable
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Unavailable
Learn
Why it happened and what stops it
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- AC-6Least PrivilegeAccess Control · mitigates 2 of these techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 2 of these techniques
- CM-8System Component InventoryConfiguration Management · mitigates 2 of these techniques
- SC-18Mobile CodeSystem and Communications Protection · mitigates 2 of these techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 2 of these techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 2 of these techniques