Improper Synchronization Vulnerability in Apache HTTP Server's mod_http2
CVE-2026-119618

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Http Server
Vendor
CVE Published:
11 November 2026

What is CVE-2026-119618?

A concurrency issue in the Apache HTTP Server's mod_http2 module can lead to the improper synchronization of resources, potentially allowing an attacker to execute remote code. This affects versions of the server from 2.4.55 to 2.4.70 and mod_h2 releases from 2.0.8 to 2.0.42, creating security risks in web applications relying on these versions.

Affected Version(s)

Apache HTTP Server 2.4.55 <= 2.4.70

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ
Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research
.