Apache HTTP服务器严重RCE漏洞

:first-child]:text-primary-blue group-data-[theme=brand]:prose-blockquote:border-white group-data-[theme=brand]:prose-blockquote:text-white group-data-[theme=brand]:[&_cite]:text-secondary-blue-medium group-data-[theme=brand]:[&_cite>:first-child]:text-secondary-blue-light prose-code:rounded-md prose-code:bg-secondary-blue-medium/10 prose-code:p-1 prose-code:font-mono prose-code:font-normal prose-code:break-all prose-code:text-primary-blue prose-code:before:hidden prose-code:after:hidden group-data-[theme=brand]:prose-code:bg-secondary-blue-dark group-data-[theme=brand]:prose-code:text-secondary-blue-medium dark-research:prose-figcaption:text-gray-light dark-research:marker:text-pink-research dark-research:prose-headings:text-white dark-research:prose-a:text-pink-research dark-research:prose-blockquote:border-pink-research dark-research:prose-blockquote:text-white dark-research:[&_cite]:text-gray-light dark-research:[&_cite>:first-child]:text-pink-research dark-research:prose-code:bg-pink-research/10 dark-research:prose-code:text-pink-research">

A critical synchronization vulnerability (CVE-2026-119618) has been identified in Apache HTTP Server’s HTTP/2 module (mod_http2). The flaw stems from a concurrent execution race condition within the assign_headers() function when handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution (RCE).

As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.

What is CVE-2026-119618?

CVE-2026-119618 is a critical, high-severity vulnerability involving a race condition in the Apache HTTP Server, which was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team.

Specifically, the flaw exists within the assign_headers() function of the HTTP/2 module (mod_http2). Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption. This memory corruption can ultimately be leveraged to achieve RCE on the hosting server, allowing unauthorized threat actors to execute arbitrary commands with the privileges of the web server process.

Wiz Research data: what’s the risk to cloud environments?

In cloud environments, a compromised Apache instance running containerized or virtualized workloads can serve as an entry point for lateral movement, potentially exposing adjacent microservices or cloud metadata endpoints.

According to Wiz data 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances. Note that this does not take configuration into account.

Which products are affected?

The vulnerability affects deployments utilizing HTTP/2 capabilities on the Apache HTTP Server within the version ranges outlined in the table below:

VendorProductAffected VersionsPatched Versions

Apache Software FoundationApache HTTP ServerFrom 2.4.55 through 2.4.702.4.71 and newer

GitHub (Open Source)mod_h2 moduleFrom 2.0.8 through 2.0.422.0.24 and newer

Which actions should security teams take?

Security operations and engineering teams should execute the following remediation and mitigation steps:

1. Upgrade Deployments

Upgrade Apache HTTP Server: Update affected installations to Apache HTTP Server version 2.4.71 or later. This release addresses the race condition in assign_headers().

Update Standalone Modules: If managing standalone mod_h2 builds from GitHub, upgrade the module to a version newer than 2.0.42.

2. Implement Temporary Mitigations

If immediate patching is not possible due to operational constraints, temporarily disable HTTP/2 support to eliminate the attack vector.

Edit the configuration file (such as httpd.conf) to restrict active protocols to HTTP/1.1 by removing h2 and h2c references:

# Restrict protocols to HTTP/1.1 Protocols http/1.1

Wiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment.

References

Apache HTTP Server release notes

#Research#Security