{"history":[{"alert":0,"cve":"CVE-2026-119618","id":23155,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00398, \"percentile\": 0.34546}"},{"alert":1,"cve":"CVE-2026-119618","id":21255,"kind":"cna","observed_at":1794478802,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2026-11-12T09:30:48.936Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/11/11/13\"}, {\"url\": \"https://access.redhat.com/security/cve/cve-2026-119618\"}, {\"url\": \"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability\"}, {\"url\": \"https://github.com/microsoft/azurelinux/pull/20165\"}, {\"url\": \"https://bugs.gentoo.org/986161\"}, {\"url\": \"https://github.com/AlmaLinux/updates/issues/4252\"}], \"title\": \"CVE Program Container\", \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Apache HTTP Server\", \"vendor\": \"Apache Software Foundation\", \"versions\": [{\"lessThanOrEqual\": \"2.4.70\", \"status\": \"affected\", \"version\": \"2.4.55\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"<p>Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.<br><span><br>This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.<br></span><span>Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.</span></p>\"}], \"value\": \"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\\n\\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.\"}], \"metrics\": [{\"other\": {\"content\": {\"text\": \"critical\"}, \"type\": \"Textual description of severity\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-362\", \"description\": \"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-11T15:55:23.793Z\", \"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\"}, \"references\": [{\"tags\": [\"vendor-advisory\"], \"url\": \"https://httpd.apache.org/security/vulnerabilities_24.html\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-26T12:00:00.000Z\", \"value\": \"reported (Anthropic)\"}, {\"lang\": \"en\", \"time\": \"2026-11-03T15:50:00.000Z\", \"value\": \"reported (Google)\"}], \"title\": \"Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers\", \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"assignerShortName\": \"apache\", \"cveId\": \"CVE-2026-119618\", \"datePublished\": \"2026-11-11T14:54:08.155Z\", \"dateReserved\": \"2026-10-30T12:32:13.904Z\", \"dateUpdated\": \"2026-11-12T09:30:48.936Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-12T09:30:48.936Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"},{"url":"https://github.com/microsoft/azurelinux/pull/20165"},{"url":"https://bugs.gentoo.org/986161"},{"url":"https://github.com/AlmaLinux/updates/issues/4252"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ"},{"lang":"en","type":"finder","value":"Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.<br><span><br>This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.<br></span><span>Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.</span></p>"}],"value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"metrics":[{"other":{"content":{"text":"critical"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","description":"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T15:55:23.793Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2026-10-26T12:00:00.000Z","value":"reported (Anthropic)"},{"lang":"en","time":"2026-11-03T15:50:00.000Z","value":"reported (Google)"}],"title":"Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-119618","datePublished":"2026-11-11T14:54:08.155Z","dateReserved":"2026-10-30T12:32:13.904Z","dateUpdated":"2026-11-12T09:30:48.936Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794478802,"cve":"CVE-2026-119618","description":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.","epss":{"date":"2026-11-12","epss":0.00398,"percentile":0.34546},"epss_checked":1794522003,"first_seen":1794463290,"kev":null,"kev_checked":1794522003,"products":"Apache Software Foundation Apache HTTP Server","references":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/13","https://access.redhat.com/security/cve/cve-2026-119618","https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","https://github.com/microsoft/azurelinux/pull/20165","https://bugs.gentoo.org/986161","https://github.com/AlmaLinux/updates/issues/4252"],"score":null,"solutions":"","state":"PUBLISHED","title":"Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","id":406,"publisher":"Wiz Research","title":"Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know | Wiz Blog"}]}