CVE-2026-119618 Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
CriticalCVSS 9.8
- Published
- Updated
- Exploit status
- No public exploit known
Description
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/mod_http2(Red Hat:enterprise_linux:10.3) | < 2.0.29-5.el10_3.1 | 2.0.29-5.el10_3.1 |
| redhat/mod_http2(Red Hat:enterprise_linux_eus:10.0) | < 2.0.29-2.el10_0.3 | 2.0.29-2.el10_0.3 |
| redhat/mod_http2(Red Hat:enterprise_linux_eus:10.2) | < 2.0.29-4.el10_2.3 | 2.0.29-4.el10_2.3 |
| redhat/mod_http2(Red Hat:enterprise_linux:9) | < 2.0.26-7.el9_9.1 | 2.0.26-7.el9_9.1 |
| redhat/mod_http2(Red Hat:rhel_e4s:9.4) | < 2.0.26-2.el9_4.4 | 2.0.26-2.el9_4.4 |
| redhat/mod_http2(Red Hat:rhel_eus:9.6) | < 2.0.26-4.el9_6.3 | 2.0.26-4.el9_6.3 |
| redhat/mod_http2(Red Hat:rhel_eus:9.8) | < 2.0.26-6.el9_8.3 | 2.0.26-6.el9_8.3 |
| redhat/httpd(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/jbcs-httpd24-mod_http2(Red Hat:jboss_core_services:1) | All versions | No fix listed |
| debian/apache2(Debian:12) | All versions | No fix listed |
| debian/apache2(Debian:12) | = 2.4.57-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.57-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.58-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb10u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.59-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.60-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.61-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb11u2 | No fix listed |
Show 121 more
| debian/apache2(Debian:12) | = 2.4.62-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-4 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-5 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.62-6 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.63-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.64-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.70-1 | No fix listed |
| debian/apache2(Debian:12) | = 2.4.71-1 | No fix listed |
| debian/apache2(Debian:13) | All versions | No fix listed |
| debian/apache2(Debian:13) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.70-1 | No fix listed |
| debian/apache2(Debian:13) | = 2.4.71-1 | No fix listed |
| debian/apache2(Debian:14) | All versions | No fix listed |
| debian/apache2(Debian:14) | = 2.4.65-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.65-3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb11u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb12u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-1~deb13u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-4 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-5 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-6 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-7 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.66-8 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb11u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb12u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-1~deb13u3 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.67-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1~deb12u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.68-2 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.69-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.69-1~deb13u1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.70-1 | No fix listed |
| debian/apache2(Debian:14) | = 2.4.71-1 | No fix listed |
| Apache HTTP Server | >= 2.4.55, <= 2.4.70 | No fix listed |
| alpine/apache2(Alpine:v3.21) | < 2.4.71-r0 | 2.4.71-r0 |
| alpine/apache2(Alpine:v3.22) | < 2.4.71-r0 | 2.4.71-r0 |
| alpine/apache2(Alpine:v3.23) | < 2.4.71-r0 | 2.4.71-r0 |
| alpine/apache2(Alpine:v3.24) | < 2.4.71-r0 | 2.4.71-r0 |
References
- security-tracker.debian.org vendor-advisory
- Red Hat CVE page vendor-advisory
- RHSA-2026:98978 patch vendor-advisory
- RHSA-2026:98953 patch vendor-advisory
- RHSA-2026:98979 patch vendor-advisory
- RHSA-2026:98981 patch vendor-advisory
- RHSA-2026:98968 patch vendor-advisory
- RHSA-2026:98954 patch vendor-advisory
- RHSA-2026:98982 patch vendor-advisory
- Red Hat Bugzilla 2567318 issue-tracking
- www.cve.org
- nvd.nist.gov
- httpd.apache.org vendor-advisory
- www.openwall.com
- access.redhat.com
- www.wiz.io
- github.com
- bugs.gentoo.org
- github.com
- security.alpinelinux.org vendor-advisory