Apache HTTP/2 Race Condition Enables Remote Code Execution

A race condition in Apache HTTP Server’s mod_http2 module allows unauthenticated attackers to corrupt heap memory and achieve remote code execution. The flaw (CVE-2026-119618) stems from improper synchronization during concurrent thread operations on shared resources. Versions 2.4.55 through 2.4.70 of Apache HTTP Server and mod_h2 versions 2.0.8 through 2.0.42 are vulnerable, with exploitation running arbitrary code at the web server process’s privilege level. Anthropic’s OSS Scanner and Google Cloud’s Vulnerability Research teams discovered the vulnerability, which Apache Software Foundation has now patched.

The potential exposure is significant. Wiz’s cloud telemetry shows 64% of cloud environments contain vulnerable resources, with roughly half exposed to the public internet—noteworthy given that Apache HTTP Server powers approximately one in five websites globally. However, practical constraints limit immediate risk: HTTP/2 must be explicitly enabled to trigger exploitation, and it defaults to off. Security researchers recommend immediate patching or disabling HTTP/2 until fixes are deployed.

No public exploits or active attacks have been reported, though researchers warn this situation could change. The patch also addresses two additional flaws: a null pointer dereference in mod_md and a low-severity data overwrite vulnerability in mod_vhost_alias.