{"affected":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"cveId":"CVE-2026-119618","cwes":["CWE-362"],"description":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794412523793,"publishedAt":1794408848155,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"}],"remediation":[],"revision":"1ba9d2648fee1aee881d557abdaeb0519c521aaaa8f28b203488f3593768f859","sources":[{"modifiedAt":1794412523793,"name":"CNA: apache","retrievedAt":1794413329944,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119618"}],"ssvc":null,"status":"published","title":"Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers","updatedAt":1794413329944}