Apache HTTP Server has addressed a critical vulnerability in its mod_http2 module that could enable unauthenticated remote code execution. The flaw, tracked as CVE-2026-119618, is described as a race condition causing heap memory corruption through improper synchronization when handling concurrent threads.
The vulnerability impacts Apache HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the web server process. The issue was discovered by Anthropic’s OSS Scanner and Google Cloud’s Vulnerability Research teams.
According to data from cloud security firm Wiz, 64% of cloud environments host vulnerable resources, and approximately half of those instances are reachable over the public internet. Researchers at watchTowr confirmed that HTTP/2 must be enabled for exploitation and recommended that administrators “patch now or drop h2 until you can.”
The latest release also resolves two additional vulnerabilities: CVE-2026-106023, a null pointer dereference in mod_md, and CVE-2026-109163, a low-severity data overwrite flaw in mod_vhost_alias. No public exploits or in-the-wild attacks have been observed so far, but the severity is rated critical by multiple researchers.
