TL;DR
A critical race condition in Apache HTTP Server’s HTTP/2 module can lead to heap corruption and remote code execution, according to Wiz. Apache HTTP Server versions 2.4.55 through 2.4.70 are affected, with version 2.4.71 and later listed as patched; Wiz says it had no reports of exploitation and no exploit was available when its report was published.
Wiz has reported a critical race-condition vulnerability in the HTTP/2 module of Apache HTTP Server that could let a remote, unauthenticated attacker corrupt heap memory and execute code on a server. The report identifies Apache HTTP Server versions 2.4.55 through 2.4.70 as affected and lists version 2.4.71 and later as patched; Wiz said no exploit or in-the-wild exploitation reports were known when its blog post was published.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The flaw, identified as CVE-2026-119618, is in the assign_headers() function of Apache’s HTTP/2 module, mod_http2. Wiz describes the cause as improper synchronization when concurrent threads access shared resources. Under the conditions described in the report, that race can corrupt heap memory and potentially be used to achieve remote code execution with the privileges of the web server process.
The reported affected range for Apache HTTP Server is 2.4.55 through 2.4.70; the listed fixed release is 2.4.71 or later. Wiz also lists standalone GitHub mod_h2 builds from versions 2.0.8 through 2.0.42 as affected, with version 2.0.24 and later shown as patched in its source material. Because those version statements appear inconsistent—the listed patched mod_h2 version is lower than the affected range’s upper end—administrators should check the project’s release information before relying on that module version number.
Wiz attributes independent discovery of the issue to Anthropic and Google Cloud’s Vulnerability Research Team. For systems that cannot be upgraded immediately, the report recommends temporarily disabling HTTP/2 by removing h2 and h2c from active protocol configuration. That mitigation removes the reported attack path but may affect service configurations that rely on HTTP/2.
Risk to Exposed Web Servers
A vulnerable internet-facing web server could provide an attacker with a route to execute code on the host, subject to the privileges of the Apache process. That makes the flaw relevant not only to the server itself but also to the workloads and services it can reach. Wiz warns that in cloud settings, a compromised Apache instance running in a container or virtual machine could become a starting point for lateral movement toward adjacent microservices or cloud metadata endpoints.
Wiz reports that 64% of cloud environments in its data had resources it classified as vulnerable and that 51% had publicly exposed instances. Those are Wiz’s measurements, not a count of confirmed exploitable servers. The company says the figures do not account for configuration, so they do not establish that every identified resource can be exploited. Still, the figures point to a potentially broad remediation task for organizations using affected Apache versions.
The vulnerability’s reported severity reflects the combination of remote access, no authentication requirement, and the possibility of code execution. The practical risk for a particular installation depends on its version, whether HTTP/2 is enabled, its configuration, and the permissions and network access available to the server process.
Products Worth Considering
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI Connectivity, Black
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, and IPX4 Water Resistance
As an affiliate, we earn on qualifying purchases.
Affected Apache and mod_h2 Releases
mod_http2 supplies HTTP/2 support in Apache HTTP Server. The reported flaw is specifically tied to concurrent handling of shared resources in that module, rather than being described as a general weakness in every Apache deployment. Wiz says the issue affects deployments using HTTP/2 capabilities within the stated version ranges.
Wiz’s guidance is to upgrade Apache HTTP Server to 2.4.71 or later. It separately lists standalone mod_h2 builds, but its stated affected and patched version ranges do not align: it gives 2.0.8–2.0.42 as affected while also naming 2.0.24 and later as patched. That discrepancy should be checked against current Apache and module release notes. The report also points Wiz customers to a prebuilt query and advisory in the Wiz Threat Center for locating potentially vulnerable resources.
“As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.”
— Wiz
Exploit Status and Version Details
Wiz reported no known exploit and no in-the-wild exploitation at the time its blog post was published. The supplied report does not establish whether that status has changed since publication, so security teams should consult current advisories and monitoring rather than assume the issue remains unexploited.
The source material does not provide technical conditions needed to determine exploitability for every configuration, nor does it report confirmed attacks or identify affected organizations. Wiz’s cloud percentages also lack a fuller description here of the sample and measurement method. In addition, the standalone mod_h2 affected and patched ranges conflict in the report; the correct fixed version for that module needs confirmation from authoritative release information.
Patch, Verify, and Monitor
Organizations should identify Apache HTTP Server installations in the reported affected range and upgrade them to 2.4.71 or later, following applicable release guidance. Teams using standalone mod_h2 builds should verify the fixed version with the project’s current release notes because of the version-range inconsistency in Wiz’s report.
Where an upgrade cannot be completed promptly, administrators can consider the report’s temporary mitigation: disable HTTP/2 by removing h2 and h2c from active protocol configuration, then verify that the service operates as intended. Security teams should also review public exposure and the permissions and network reach of affected web-server processes, and monitor updated vendor and researcher advisories for changes in exploit status or remediation guidance.
Key Questions
What is CVE-2026-119618?
It is a reported race-condition vulnerability in Apache HTTP Server’s HTTP/2 module, mod_http2. Wiz says the flaw can cause heap corruption that may lead to remote code execution.
Which Apache HTTP Server versions are affected?
Wiz lists Apache HTTP Server versions 2.4.55 through 2.4.70 as affected and 2.4.71 or later as patched. The report says the issue concerns deployments using HTTP/2 capabilities.
Is there a known exploit?
Wiz said no exploit was available and it had no reports of exploitation in the wild when its blog post was published. The source material does not confirm the status after that publication.
What should administrators do if they cannot patch immediately?
Wiz recommends temporarily disabling HTTP/2 by removing h2 and h2c from active protocol configuration, then upgrading when possible. Administrators should check service dependencies before changing protocol settings.
Are standalone mod_h2 versions affected?
Wiz lists standalone mod_h2 versions 2.0.8 through 2.0.42 as affected, but its stated patched range begins at 2.0.24, creating an overlap. Confirm the correct fixed release with current project documentation before deciding a build is safe.
Source: wiz.io
