Apache HTTP/2 RCE

What is the Vulnerability?

CVE-2026-119618 is a race condition (CWE-362) in Apache HTTP Server’s mod_http2 module. In assign_headers(), the module writes to a header table that is shared between the connection thread and worker threads without adequate synchronization. Concurrent access can corrupt the Apache child-process heap, which can be leveraged toward remote code execution in the worker process.

Exploitation requires no authentication and no user interaction. The server only reaches the vulnerable code when HTTP/2 is enabled through the Protocols directive (h2 or h2c). The Apache default is HTTP/1.1, which is not exposed.

Apache HTTP Server is one of the most widely deployed web servers, and this flaw is reachable by an unauthenticated attacker over the network on any instance with HTTP/2 enabled.

What is the recommended Mitigation?

Affected versions:

• Apache HTTP Server 2.4.55 through 2.4.70, when HTTP/2 is enabled.

• Standalone mod_h2 2.0.8 through 2.0.42.

1. Apply the security update. Upgrade to Apache HTTP Server 2.4.71 or later, or install the distribution vendor’s fixed package, then restart httpd. Prioritize internet-facing servers with HTTP/2 enabled.

2. Confirm exposure. Check whether mod_http2 is loaded (apachectl -M | grep http2) and whether any Protocols directive includes h2 or h2c, globally or per virtual host. Servers without HTTP/2 are not affected.

3. If patching is delayed, set Protocols http/1.1 and check every virtual host. This removes exposure but is not a substitute for patching.

4. Rebuild containers. Rebuild and redeploy container images that bundle the affected Apache versions. Restarting a running container does not update the binary.

5. Standalone mod_h2 users should disable HTTP/2 until a fixed standalone release is available.

6. Monitor for signs of exploitation. Correlate HTTP/2 request bursts with Apache worker crashes, segmentation faults, or restarts. Alert on unexpected child processes spawned by httpd or apache2, and on new files in web roots or temporary directories.

What FortiGuard Coverage is available?

• FortiGuard Labs is monitoring CVE-2026-119618 and will update this Threat Signal as new threat intelligence and protection information becomes available.

• FortiGuard IPS has released signature coverage to detect and protect against attacks targeting CVE-2026-119618.

IPS Signature 60872

• FortiGuard Vulnerability Management (Endpoint Vulnerability): Released endpoint vulnerability detection that identifies hosts running the affected Apache HTTP Server versions, available in endpoint vulnerability package 2.00814 for Linux.

FortiGuard Labs

• FortiGuard Antivirus & Behavior Detection detects and blocks malicious files, web shells, and other payloads that may be delivered or installed following successful exploitation.

• FortiGuard Web Filtering blocks access to known malicious domains, command-and-control infrastructure, and payload-hosting locations associated with post-exploitation activity.

• FortiGuard Indicators of Compromise (IOC) Service can help identify known indicators associated with compromise and malicious infrastructure.

• FortiEDR provides endpoint detection and response capabilities to identify and contain suspicious post-exploitation activity, including unexpected processes and malicious behavior on potentially compromised Apache servers.

• FortiGuard Incident Response supports investigation, containment, and recovery following suspected compromise of affected Apache HTTP Server deployments.