{
  "id": 19626224,
  "title": "CVE-2026-119618: Apache HTTP/2 Pre-Auth RCE — What the Race Condition Actually Does",
  "url": "https://urgent.news/2026/11/12/cve-2026-119618-apache-http-2-pre-auth-rce-what-the-race-condition",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T09:01:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/threataft_dev/cve-2026-119618-apache-http2-pre-auth-rce-what-the-race-condition-actually-does-25om"
  },
  "original_language": "en",
  "account": "A critical pre-authentication remote code execution vulnerability (CVE-2026-119618) has been discovered in Apache HTTP Server's mod_http2 module. The flaw, which is assigned a CVSS score of 9.8, allows attackers to execute arbitrary code without the need for credentials or user interaction. The vulnerability exists in Apache HTTP Server versions 2.4.55 through 2.4.70, as well as standalone mod_h2 versions 2.0.8 through 2.0.42, provided that HTTP/2 is enabled.\n\nMod_http2 is designed to ensure that worker threads never access the connection's shared allocator. Each worker gets its private allocator. However, the assign_headers() function breaks this rule under specific conditions: body-less requests with Content-Type and no Content-Length, and when the request header table is full. The worker writes a synthetic Content-Length: 0 into the shared stream table, leading to a race condition with the connection thread on a lock-free free list. Two threads may attempt to use the same node, corrupting the heap and creating a primitive that can be turned into code execution.\n\nThis vulnerability affects Apache HTTP Server containers, and ThreadSanitizer evidence, as well as a standard library HTTP/2 proof-of-concept, have been shared on GitHub under the CVE identifier. The vulnerability can be mitigated by upgrading to Apache HTTP Server 2.4.71 or mod_h2 2.0.43. If patching is not immediately possible, disabling HTTP/2 in all configuration files and virtual host blocks can help prevent exploitation. According to Scale Wiz, 64% of cloud environments have resources on a vulnerable version, and 51% have publicly exposed instances.",
  "summary": "There is a CVSS 9.8 pre-authentication remote code execution vulnerability in Apache HTTP Server’s mod_http2 module. It was fixed on 11 November 2026 in version 2.4.71. If you run Apache with HTTP/2 enabled and you have not patched, this post is for you. What happens mod_http2 is designed so that worker threads never touch the connection’s shared allocator — each worker gets a private one.…",
  "key_points": [],
  "editors_take": "The race condition within the modhttp2 module transforms a memory management error into a critical entry point for unauthenticated attackers to seize control of widely deployed web server environments.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}