Image vulnerability, severity high
Apache HTTP Server mod_http2 race condition RCE (CVE-2026-119618) affects 2.4.55 through 2.4.70
Published
A race condition in Apache HTTP Server's mod_http2 module (assign_headers) can corrupt heap memory and let an unauthenticated attacker run code with the web server process's privileges. It affects HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42, and only when HTTP/2 is enabled (off by default). Wiz says it knows of no public exploits or attacks yet, but many internet-facing servers are vulnerable.
What's affected
- httpd (container image)2.4.55; 2.4.56; 2.4.57; 2.4.58; 2.4.59; 2.4.60; 2.4.61; 2.4.62; 2.4.63; 2.4.64; 2.4.65; 2.4.66; 2.4.67; 2.4.68; 2.4.69; 2.4.70
What to do
- Update Apache HTTP Server to the latest release that fixes CVE-2026-119618.
- If you cannot patch yet, disable HTTP/2 (mod_http2) until you can.
- Check whether any internet-facing servers have HTTP/2 enabled, since it is off by default.
Check whether you were affected
To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it. The check is free and needs no account:
/pharon:check-incident apache-httpd-http2-rce-2026-11Don't wait for the next one to reach the news. Pharon tells the team that owns the affected repo within minutes. Free for 7 days, no card.
Get alerted for the next oneReferences
Notice apache-httpd-http2-rce-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.