A crucial synchronization exposure (CVE-2026-119618) has been identified in Apache HTTP Server’s HTTP/2 component (mod_http2). The flaw stems from a concurrent implementation competition circumstance inside the assign_headers() function whenever handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap recollection to accomplish arbitrary code implementation (RCE).
As of the period of this blog’s publication, no utilize is accessible and there are no reports of exploitation in the wild.
CVE-2026-119618 is a critical, high-severity exposure involving a competition circumstance in the Apache HTTP Server, which was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team.
Specifically, the flaw exists inside the assign_headers() function of the HTTP/2 component (mod_http2). Due to improper synchronization whenever executing concurrent threads sharing resources, an attacker can trigger heap corruption. This recollection misconduct can ultimately be leveraged to accomplish RCE on the hosting server, allowing unauthorized danger actors to execute arbitrary commands alongside the privileges of the web server process.
In haze environments, a compromised Apache case operating containerized or virtualized workloads can assist as an admission item for lateral movement, possibly exposing neighboring microservices or haze metadata endpoints.
According to Wiz data 64% of haze environments have resources susceptible to CVE-2026-119618, and 51% of haze environments have publically exposed instances. Note that this does not obtain configuration into account.
The exposure affects deployments using HTTP/2 capabilities on the Apache HTTP Server inside the type ranges outlined in the array below:
Security operations and engineering teams should execute the following remediation and mitigation steps:
1. Upgrade Deployments
Upgrade Apache HTTP Server: Update affected installations to Apache HTTP Server type 2.4.71 or later. This publish addresses the competition circumstance in assign_headers().
Update Standalone Modules: If managing standalone mod_h2 builds from GitHub, upgrade the component to a type newer than 2.0.42.
2. Implement Temporary Mitigations
If contiguous patching is not imaginable because of operational constraints, temporarily disable HTTP/2 assistance to eliminate the assault vector.
Edit the configuration document (such as httpd.conf) to restrict energetic protocols to HTTP/1.1 by removing h2 and h2c references:
Wiz customers can use the pre-built query and advisory in the Wiz Threat Center to hunt for susceptible instances in their environment.
