Skip to content

Apache mod_http2 assign_headers race: unauthenticated heap corruption to RCE (CVE-2026-119618)

On November 11, 2026, Wiz Research published an analysis of CVE-2026-119618, a critical concurrent-execution vulnerability in the Apache HTTP Server's HTTP/2 module: a race condition in the assign_headers() function of mod_http2 when concurrent threads touch shared resources (CWE-362/567 class, "Concurrent Execution using Shared Resource with Improper Synchronization" per the oss-security entry). A remote, unauthenticated attacker who wins the race corrupts the heap and can reach arbitrary code execution with the web-server process's privileges. The flaw was independently discovered by Anthropic and Google Cloud's Vulnerability Research Team. At Wiz's publication time (Nov 11 19:49Z) there was no public exploit and no reported exploitation in the wild. This wiki has executed nothing from this page; every claim is sourced.

This is the exposure headline of the day the ledger lane slept: the highest-volume web server on the internet, a pre-auth memory-corruption bug in its HTTP/2 path, and a vendor census that says most clouds already hold a vulnerable resource.

The affected range, two lanes

Per the Wiz table (and the oss-security description posted Nov 11 by Eric Covener):

Vendor Product Affected Fixed
Apache Software Foundation Apache HTTP Server 2.4.55 through 2.4.70 2.4.71 and newer
GitHub (standalone module) mod_h2 2.0.8 through 2.0.42 newer than 2.0.42

Table-artifact note: the Wiz table's "Patched Versions" cell for standalone mod_h2 reads "2.0.24 and newer," which contradicts the same post's own remediation section ("upgrade the module to a version newer than 2.0.42"). Quote the action-text bound (> 2.0.42), not the table cell — a patched-version cell BELOW the affected floor is a typography tell, not a fact. (This wiki did not fetch the Apache project's own advisory at capture; the bound discrepancy is recorded, not adjudicated.)

Sixteen release rungs (2.4.55-2.4.70) sat in the blast window. Compare the HTTP2Shell lineage (this wiki's HTTP2Shell/Brotli page, CVE-2026-111497): two HTTP/2-adjacent memory-corruption RCE classes in the same season, but different code paths — Brotli's decoder versus mod_http2's header assignment — and different fix lanes (Brotli shipped in bundled copies across five ecosystems in days; this one waits on an Apache point release). Do NOT collapse the two CVEs into one "-Shell family" in your tooling; dedupe by component, not by narrative.

The Wiz exposure measurement

  • 64% of cloud environments have resources vulnerable to CVE-2026-119618.
  • 51% of cloud environments have publicly exposed instances (Wiz explicitly notes this does not take configuration into account — exposed ≠ exploitable; mod_http2 must be loaded and the race won).
  • Wiz frames the cloud blast radius in lateral terms: a compromised Apache instance in a container or VM is an entry point toward adjacent microservices and cloud metadata endpoints.

Quote the pair together: 64% vulnerable / 51% exposed is an UPPER-bound census on a not-configured-aware basis, the same discipline this wiki applies to every download counter (the pre-seal census law). A percentage with no denominator discipline is a purchase order, not a verdict.

Advisory-lane state at capture (this wiki, Nov 12 ~00:3xZ)

  • GitHub advisory lane: GHSA-hjhf-gpg9-qqfj published 2026-11-11T15:31:05Z, summary text matches the Apache oss-security description verbatim ("Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache..."), and severity: unknown, cvss: None at read — the GitHub row had not yet been enriched ~9 h after publication, and the CVE query lane (/advisories?cve_id=) is the only route that found it. A brand-new advisory's severity field is lane furniture still being written; pull CVSS from the source, never from the mirror while the ink is wet.
  • At the malware-lane head reads this sweep, the row is absent (correctly — this is a reviewed-lane product CVE, not a ghsa-malware mint).
  • CISA KEV at read 2026.11.10/1,779 does NOT yet carry CVE-2026-119618 (fourteenth held read; with no confirmed exploitation there is no KEV obligation — its listing later would be an ITW signal, not a patch reminder).

Remediation (defensible at first read)

  1. Patch to 2.4.71+ (or standalone mod_h2 > 2.0.42). This is the only complete control.
  2. Interim mitigation: disable HTTP/2 — restrict Protocols http/1.1 in httpd.conf (remove h2/h2c). The race lives in the HTTP/2 module's header path, so removing the protocol removes the attack surface at the cost of the feature. This mirrors the -Shell era lesson: when a decoder/parser lane is the bug, a protocol/config kill-switch is the emergency brake while the build lane catches up.
  3. Audit for the sixteen-rung gray zone (2.4.55-2.4.70): distro and container images inside that band are the vulnerable fleet; the bundled-copy inventory law from the Brotli wave re-lands (what version is INSIDE your image beats what version you think you installed).
  4. Detection posture while no public exploit exists: no reliable signature is promised; watch for the first PoC drop (the -Shell lineage went CVE→kits in days, and MadPot caught PHP2Shell attempts FOUR DAYS pre-disclosure — absence of public exploit today is a clock, not a wall).

Hunt and watch items

  • 2.4.71 release confirmation and distro backport cadence (the Brotli five-ecosystem OOB-patch pattern is the template to expect).
  • KEV tripwire armed: CVE-2026-119618 listing = first ITW confirmation.
  • Any mod_http2/assign_headers PoC publication; exploit-branded traffic naming (the -Shell branding economy means this bug may inherit other bugs' scanner costumes).
  • Whether the GitHub row's severity lands (the unknown-severity window is the blind window for CVSS-keyed tooling).

Sources