IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.1High

CVE-2026-119618Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Apache Software Foundation Apache HTTP Server Published: (4 days ago)

Description

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Weakness (CWE): CWE-362

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
Apache Software Foundation Apache HTTP Server 2.4.55 – ≤ 2.4.70
apache http server 2.4.55 – < 2.4.71
icing mod http2 2.0.8 – < 2.0.42

Ubuntu fixes

  • USN-9090-1 Apache HTTP Server vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04, 20.04, 18.04, 16.04, 14.04 · 13.11.2026 · apache2

References and patches

CPE matches (NVD) (2)
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* ≥ 2.4.55 < 2.4.71
  • cpe:2.3:a:icing:mod_http2:*:*:*:*:*:apache_httpd:*:* ≥ 2.0.8 < 2.0.42

Recent CVEs in the same product — Ubuntu 20.04 LTS

7.7High
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

Unscored
CVE-2026-98912

ALSA: seq: oss: Reject reads that cannot fit the next event

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it f…

7.5High
CVE-2026-98911

dpaa2-switch: fix the error path in dpaa2_switch_rx()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect sinc…