From Wiz · · 40s
Critical Apache HTTP Server Vulnerability Exposed
Remote attackers can exploit a critical flaw in Apache HTTP Server to run arbitrary code.
In brief
Remote attackers can exploit a critical flaw in Apache HTTP Server to run arbitrary code. A critical vulnerability in Apache HTTP Server allows remote code execution if exploited. Originally reported by Wiz.
Critical Vulnerability Found
A critical synchronization vulnerability (CVE-2026-119618) affects Apache HTTP Server's HTTP/2 module.
Exploitation Risk
If successfully exploited, a remote unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution.
Current Status
As of this blog's publication, no exploit is available and there are no reports of exploitation in the wild.
Affected Products
The vulnerability affects Apache HTTP Server versions from 2.4.55 through 2.4.70 and mod_h2 module versions from 2.0.8 through 2.0.42.
At a glance
A critical vulnerability in Apache HTTP Server allows remote code execution if exploited.
