Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
A critical vulnerability in the Apache HTTP Server HTTP/2 module could allow unauthenticated attackers to execute code remotely.
🌍 Cross-language spread
PULSE detected this story across 2 language editions of the world's news.
Detected by matching proper nouns and figures that survive translation. Times reflect when each edition's coverage was first indexed.
Velocity
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
A critical vulnerability has been identified in the Apache HTTP Server's HTTP/2 module, according to reports. BigGo Finance stated that versions 2.4.55 through 2.4.70 are affected by the issue, which could allow remote code execution via HTTP/2. Rescana reported that Apache HTTP Server version 2.4.71 fixes the critical mod_http2 heap corruption, designated as CVE-2026-119618.
Additional details on the mechanism of the flaw were provided by other sources. news.lavx.hu reported that a race condition in the Apache HTTP Server HTTP/2 module exposes servers to remote code execution. The Hacker News also noted that the critical Apache HTTP/2 flaw could let unauthenticated attackers execute code remotely.
Security teams and administrators managing affected systems are advised to review their software versions and apply the necessary patches provided by the vendor. The vulnerability highlights ongoing risks associated with HTTP/2 protocol implementations in widely used web servers.
Synthesized by PULSE from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 1d ago.
Quick answers
Which versions of the Apache HTTP Server are affected?
Versions 2.4.55 through 2.4.70 are affected by the vulnerability according to BigGo Finance.
What is the designation and fix for the vulnerability?
Rescana reported that the vulnerability is tracked as CVE-2026-119618 and is fixed in Apache HTTP Server version 2.4.71.
What kind of flaw is it?
It involves a race condition and heap corruption in the mod_http2 module that could allow unauthenticated attackers to execute code remotely.
Coverage (6)
- CVE-2026-119618: A Critical Apache HTTP/2 Flaw Can Lead to Remote Code Execution Bitsight · 1d ago
- Race condition in Apache HTTP Server HTTP/2 module exposes servers to remote code execution news.lavx.hu · 1d ago
- Critical Vulnerability in Apache HTTP Server Could Allow Remote Code Execution via HTTP/2; Versions 2.4.55–2.4.70 Affected BigGo Finance · 1d ago
- Apache HTTP Server 2.4.71 Fixes Critical mod_http2 Heap Corruption (CVE-2026-119618) Rescana · 1d ago
- Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know wiz.io · 1d ago
- Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely The Hacker News · 1d ago
Topics
Related trends
OpenAI launches security products, tells orgs they’re doomed if they don’t use them
OpenAI launches new security products while warning organizations that they face failure without adoption.
FBI says US has seized $1.2 billion worth of cryptocurrency stolen from Binance
Federal authorities seize over $1.2 billion in cryptocurrency following a massive $6.3 billion hack linked to North Korea.
Maersk confirms data breach as WhiteArmor ransomware demands $5 million
Maersk confirms data breach as WhiteArmor ransomware gang demands $5 million ransom, marking latest cyber hit on global shipping.
Lego marketplace BrickLink offline after 'unusual activity' detected
Lego's BrickLink marketplace remains offline for a fifth day after the company detected unusual activity, disrupting sellers and delaying a major designer program announcement.
If hackers can take over a supermarket fridge, what else is at risk?
French supermarket refrigerators and freezers were hacked, prompting US and European officials to warn that connected appliances are a new front in state-linked cyberattacks.
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
eMudhra revokes eight additional certificate authorities previously declared unaffected following a major security failure.