TL;DR
CVE-2026-119618 is a critical flaw in the HTTP/2 module (mod_http2) of Apache HTTP Server 2.4.55 through 2.4.70. A remote attacker with no credentials can run arbitrary code on the server. As of publication, there are no reports of exploitation in the wild. Upgrade to 2.4.71 or later, or turn off HTTP/2 if you can't patch yet. Not every operating system has a fixed package yet, and servers behind a standard HTTP load balancer are not exposed in the usual setup.
How to fix CVE-2026-119618
Upgrade Apache HTTP Server to version 2.4.71 or later. This release fixes the race condition in assign_headers().
- Apache HTTP Server: upgrade to 2.4.71 or later.
- Standalone mod_h2 builds from GitHub: upgrade to a version newer than 2.0.42.
- Operating system packages: apply your vendor's update when it ships. Not every operating system has a fixed package yet.
How Aikido helps
Aikido can detect CVE-2026-119618 in your container images and on your connected VMs, so you can see which Apache HTTP Server instances are affected.
Detection follows vendor advisories. Where a vendor hasn't published a fixed package yet, a host can be vulnerable without showing as affected, so check your distribution's tracker as well.
If you haven’t connected your VMs yet, go to Virtual Machines in Aikido and select Connect VMs. Aikido supports AWS, Azure and GCP.
If you can't patch yet
This step reduces exposure. It does not fix the bug, so upgrade as soon as a fixed package is available.
Disable HTTP/2. This removes the attack vector. In your Apache configuration file (for example httpd.conf), remove the h2 and h2c references and limit the active protocols to HTTP/1.1:
# Restrict protocols to HTTP/1.1
Protocols http/1.1
Who is affectedWho is affected
Any server running Apache HTTP Server with HTTP/2 enabled, within these version ranges.
What sits in front of Apache changes your exposure. Servers behind a standard HTTP load balancer are not exposed in the usual setup.
How serious is it?
Treat this as urgent for any internet-facing Apache server with HTTP/2 enabled. An unauthenticated remote attacker can run commands with the privileges of the web server process. In cloud environments, a compromised Apache instance running containerized or virtualized workloads can also be an entry point for lateral movement, and an attacker may reach adjacent microservices or cloud metadata endpoints.
As of publication, there are no reports of exploitation in the wild.
What is CVE-2026-119618?
CVE-2026-119618 is a critical race condition in the HTTP/2 module (mod_http2) of Apache HTTP Server, listed in Apache's security advisory. Anthropic and Google reported it to Apache.
In plain terms, concurrent threads use the same shared resources without coordinating properly. In the assign_headers() function, that improper synchronization lets an attacker trigger heap corruption. The corruption can be turned into remote code execution, so an unauthenticated attacker can run arbitrary commands on the hosting server.
