Glonce

Wiz flags critical Apache HTTP Server mod_http2 RCE flaw, CVE-2026-119618

securityThe Glonce editorsHacker News🔥77Glonce rating77Impact80Novelty75Relevance75Surprise60Players65Credibility70
Wiz flags critical Apache HTTP Server mod_http2 RCE flaw, CVE-2026-119618

Wiz has published an advisory on CVE-2026-119618, a critical synchronization vulnerability in the HTTP/2 module (mod_http2) of Apache HTTP Server. According to Wiz, the flaw is a concurrent-execution race condition in the assign_headers() function, which mishandles shared resources. Because threads that share resources are not properly synchronized, an attacker can trigger heap corruption. If exploited, a remote, unauthenticated attacker can turn that memory corruption into arbitrary code execution, running commands with the privileges of the web server process.

Wiz says the bug was independently discovered by Anthropic and by Google Cloud's Vulnerability Research Team. At the time of the blog's publication, Wiz states, no exploit is available and there are no reports of exploitation in the wild.

For cloud environments, Wiz warns that a compromised Apache instance running containerized or virtualized workloads can serve as an entry point for lateral movement, potentially exposing adjacent microservices or cloud metadata endpoints. Using its own data, Wiz says 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% have publicly exposed instances. Wiz notes that these figures do not take configuration into account.

The vulnerability affects deployments that use HTTP/2 on Apache HTTP Server within certain version ranges. The remediation is to update to Apache HTTP Server 2.4.71 or later, which Wiz says addresses the race condition in assign_headers(). Anyone managing standalone mod_h2 builds from GitHub should upgrade to a version newer than 2.0.42. If patching cannot happen right away because of operational constraints, Wiz advises temporarily disabling HTTP/2 to remove the attack vector: edit the configuration file (such as httpd.conf) to restrict active protocols to HTTP/1.1 by removing the h2 and h2c references, using the directive "Protocols http/1.1". Wiz customers can use a pre-built query and advisory in the Wiz Threat Center to find vulnerable instances. The advisory's overall message: immediate patching is advised.

Key facts

  • CVE-2026-119618 is a race condition in assign_headers() in Apache HTTP Server's mod_http2 that can cause heap corruption and let an unauthenticated remote attacker run arbitrary code.
  • Wiz says Anthropic and Google Cloud's Vulnerability Research Team discovered the flaw independently.
  • Wiz data: 64% of cloud environments have vulnerable resources and 51% have publicly exposed instances, not accounting for configuration.
  • Fix: Apache HTTP Server 2.4.71 or later; standalone mod_h2 builds need a version newer than 2.0.42.
  • Stopgap: disable HTTP/2 by restricting protocols to HTTP/1.1. Wiz reports no available exploit and no exploitation in the wild at publication.

Why it matters

Apache HTTP Server is a widely deployed web server, and this flaw sits in its HTTP/2 module and needs no authentication. A successful attack would run commands with the web server process's privileges. Wiz also points to the cloud angle: a compromised instance could be a foothold for lateral movement toward adjacent microservices or cloud metadata endpoints. That the bug was found independently by two parties, Anthropic and Google Cloud's Vulnerability Research Team, is a notable detail of the disclosure.

Who it affects

Anyone running Apache HTTP Server with HTTP/2 enabled within the affected version ranges, and anyone using standalone mod_h2 builds from GitHub. Wiz's own data puts 64% of cloud environments as holding vulnerable resources and 51% as having publicly exposed instances. The exact affected ranges are not listed in the text of the advisory; only the fixed versions are named.

How to use it

Upgrade Apache HTTP Server to 2.4.71 or later. If you manage standalone mod_h2 from GitHub, move to a version newer than 2.0.42. If you cannot patch immediately, temporarily switch off HTTP/2 by editing httpd.conf (or the equivalent file), removing the h2 and h2c references and setting "Protocols http/1.1". Wiz customers can run the pre-built query and advisory in the Wiz Threat Center to locate vulnerable instances.

How solid is it

The source is a vendor blog from Wiz, which sells cloud security products and promotes its own tooling on the page. The technical description is brief: a race condition in assign_headers() leading to heap corruption, with no further detail on the exploitation mechanism. The 64% and 51% figures are Wiz's own, with no sample size given and configuration not taken into account. No CVSS score is given; the text calls the flaw critical. The page also uses a second identifier, CVE-2026-111497, in one heading, while everything else says CVE-2026-119618.

Risks and caveats

Wiz says no exploit is available and none has been seen in the wild, but that is a statement as of the blog's publication and can change. The percentages describe potential exposure, not confirmed exploitable systems, since they ignore configuration. Disabling HTTP/2 is only a temporary mitigation and means falling back to HTTP/1.1. No publication, disclosure or patch release date is given in the text, and there is no Apache Software Foundation statement in it.

“Immediate patching is advised.”

— Wiz