Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE

What this means

The severity of this vulnerability has not been scored yet. There is no confirmed exploitation of it yet.

Scoring and exploitation

Not reported

Estimated attack likelihood

~0.4% estimated chance of attack in 30 daysModel estimate (EPSS): a probability signal, not confirmed exploitation

Exploited in the wild

Not confirmed in the known-exploited catalogue

Known ransomware use

Not reported

Weaknesses (CWE)

References

7 links from the CVE record, grouped by site.

• httpd.apache.org1 link

  • vulnerabilities_24.html (opens in a new tab)

• openwall.com1 link

  • 13 (opens in a new tab)

• access.redhat.com1 link

  • cve-2026-119618 (opens in a new tab)

• bugs.gentoo.org1 link

  • 986161 (opens in a new tab)

• github.com2 links

  • 4252 (opens in a new tab)
  • 20165 (opens in a new tab)

• wiz.io1 link

  • cve-2026-119618-rce-apache-http-server-vulnerability (opens in a new tab)