CVE-2026-119618

Published 11 November 2026 · tracked since 12 November 2026

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-82978 MEDIUM 4.3
• CVE-2026-77168 MEDIUM 4.3
• CVE-2026-68486 MEDIUM 5.4
• CVE-2026-68485 MEDIUM 4.3
• CVE-2026-65820
• CVE-2026-62971 HIGH 7.2
• CVE-2026-108562 MEDIUM 5.4
• CVE-2026-108560 MEDIUM 6.1
• CVE-2026-107662 HIGH 8.8
• CVE-2026-77882 HIGH 7.8

→ Open the live CVE board · all tools