CVE-2026-119618 in apache software foundation apache http server
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Affected software: apache software foundation apache http server
Scores
- CVSS: Not scored yet
- EPSS: 0.40% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-11
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
In the news
2 publications wrote about this CVE in the last 14 days, most recently on 2026-11-12.
- Apache HTTP Server patches critical HTTP/2 remote code execution flaw (BleepingComputer, 2026-11-12)
- ASPM in the AI Era Part 3: Fixing Risk at the Speed of Code (Wiz, 2026-11-12)
- Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know (Wiz, 2026-11-11)
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.