[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDklI6ERStW9QbNJhEvM4o8AuzKG5JauKZyxaZ6Qx4TY":3},{"article":4,"iocs":31,"watch_terms":36,"solutions":37,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c8a40b97-9509-4723-ada2-4875a0dce356","CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability","cve-2026-119618-apache-http-server-mod-http2-race-condition-remote-code-executio-a251c1","CVE-2026-119618 is a critical race condition in Apache HTTP Server's mod_http2 that can lead to remote code execution without credentials. Fixed in 2.4.71. See affected versions, mitigations, and the NodeZero Rapid Response test.","CVE-2026-119618 is a critical race condition in Apache HTTP Server's mod_http2 module, specifically within the assign_headers() function, that can lead to remote code execution. The vulnerability arises from improper synchronization of a shared resource, corrupting heap memory. Attackers can exploit this by reaching the server over HTTP\u002F2 without requiring credentials. The vulnerability affects Apache HTTP Server versions from 2.4.55 through 2.4.70 and is fixed in version 2.4.71.","Apache HTTP Server mod_http2 race condition vulnerability allows RCE.","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fvulnerabilities\u002Fcve-2026-119618\u002F","https:\u002F\u002Fhorizon3.ai\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage.png","2026-11-12T20:17:28+00:00","2026-11-12T21:00:17.000317+00:00",9,[17,20],{"name":18,"type":19},"Apache HTTP Server","product",{"name":21,"type":22},"mod_http2","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},[32],{"type":33,"value":34,"context":35},"cve","CVE-2026-119618","Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability",[18],{"controls":38,"vendors":126},[39,68,97],{"slug":40,"name":41,"problem":42,"products":43},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[44,52,60],{"vendor_slug":45,"vendor_name":46,"vendor_logo":47,"product_slug":48,"product_name":49,"url":50,"description":51},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":69,"name":70,"problem":71,"products":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":98,"name":99,"problem":100,"products":101},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-firewall","Sophos Firewall","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fnext-gen-firewall","Next-generation firewall with intrusion prevention.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":137},"critical-apache-http2-race-condition-enables-unauthenticated-remote-code-execution","Critical Apache HTTP\u002F2 Race Condition Enables Unauthenticated Remote Code Execution","A race condition in Apache HTTP Server's mod_http2 module allows unauthenticated attackers to corrupt heap memory and achieve remote code execution simply by sending HTTP\u002F2 requests — no credentials required. The root cause is improper synchronization of a shared resource within the assign_headers() function, a class of flaw that is difficult to detect through routine code review but devastating in production. This vulnerability affected a wide swath of Apache deployments (versions 2.4.55 through 2.4.70), meaning organizations slow to patch were exposed to full server compromise. It underscores why timely patching of internet-facing web infrastructure is non-negotiable, especially when fixes are publicly available.",[132,133,134,135,136],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(e)":138,"NIST SP 800-53 SI-2: Flaw Remediation":139,"MITRE ATT&CK T1190: Exploit Public-Facing Application":140,"CIS Control 7: Continuous Vulnerability Management (v8)":141,"CIS Control 2: Inventory and Control of Software Assets (v8)":142},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling, requiring operators to have processes to identify and remediate flaws like this race condition in a timely fashion.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, directly addressing the need to patch this critical Apache vulnerability promptly.","This technique covers adversaries exploiting vulnerabilities in internet-facing services such as Apache HTTP Server to gain initial access, which is precisely the attack vector this CVE enables.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying this would have ensured CVE-2026-119618 was detected and patched before attackers could exploit the publicly available fix window.","CIS Control 2 requires maintaining an accurate inventory of all software in use, which would have allowed rapid identification of every Apache instance running a vulnerable version."]