Critical Apache HTTP Server vulnerability can allow remote code execution (CVE-2026-119618)
Critical Apache HTTP Server vulnerability CVE-2026-119618 allows remote code execution.
A critical vulnerability, CVE-2026-119618, has been discovered in Apache HTTP Server versions 2.4.55 through 2.4.70, specifically within the mod_http2 module. This flaw allows unauthenticated remote attackers to execute arbitrary code on the server. While there are no current reports of exploitation in the wild, users are advised to upgrade to version 2.4.71 or later, or disable HTTP/2 if patching is not immediately possible.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apache Software Foundation?
Get an email when a new story names Apache Software Foundation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-119618