CVE-2026-119618: Apache HTTP/2 Pre-Auth RCE — What the Race Condition Actually Does

A critical pre-authentication remote code execution vulnerability (CVE-2026-119618) has been discovered in Apache HTTP Server's mod_http2 module. The flaw, which is assigned a CVSS score of 9.8, allows attackers to execute arbitrary code without the need for credentials or user interaction. The vulnerability exists in Apache HTTP Server versions 2.4.55 through 2.4.70, as well as standalone mod_h2 versions 2.0.8 through 2.0.42, provided that HTTP/2 is enabled.

Mod_http2 is designed to ensure that worker threads never access the connection's shared allocator. Each worker gets its private allocator. However, the assign_headers() function breaks this rule under specific conditions: body-less requests with Content-Type and no Content-Length, and when the request header table is full. The worker writes a synthetic Content-Length: 0 into the shared stream table, leading to a race condition with the connection thread on a lock-free free list.

Two threads may attempt to use the same node, corrupting the heap and creating a primitive that can be turned into code execution.

This vulnerability affects Apache HTTP Server containers, and ThreadSanitizer evidence, as well as a standard library HTTP/2 proof-of-concept, have been shared on GitHub under the CVE identifier. The vulnerability can be mitigated by upgrading to Apache HTTP Server 2.4.71 or mod_h2 2.0.43. If patching is not immediately possible, disabling HTTP/2 in all configuration files and virtual host blocks can help prevent exploitation.

According to Scale Wiz, 64% of cloud environments have resources on a vulnerable version, and 51% have publicly exposed instances.