Apache fixes severe code execution flaw discovered in web server module

The Apache Software Foundation has released fixes for a critical flaw in Apache HTTP Server that allows unauthenticated attackers to execute arbitrary code remotely. Tracked as CVE-2026-119618, the vulnerability was discovered by Anthropic's OSS Scanner alongside Google Cloud's Vulnerability Research teams. It impacts Apache HTTP Server versions 2.4.55 through 2.4.70 as well as standalone mod_h2 versions 2.0.8 through 2.0.42. [1][2]

The bug is a race condition in the mod_http2 module caused by improper thread synchronization within assign_headers(), which can corrupt heap memory and allow an attacker to run commands with the web server process's privileges. Exploitation requires servers to have HTTP/2 enabled, a setting that is turned off by default. Cloud security firm Wiz reports that 64% of analyzed cloud environments contain vulnerable resources, with about half of those instances publicly exposed. Security firm watchTowr advises administrators to apply the updates immediately or disable HTTP/2 support. [1][2]

Wiz noted that it is not aware of any active in-the-wild attacks or public exploits targeting the flaw so far. Alongside the remote code execution fix, the latest Apache HTTP Server release addresses two other issues: a null pointer dereference vulnerability tracked as CVE-2026-106023 in mod_md, and a low-severity data overwrite problem identified as CVE-2026-109163 in mod_vhost_alias. [1]