CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5797 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-119618 Apache mod_http2 Post-Exploitation — httpd Spawning Shell or Download Tool (Splunk SPL)

Detects Apache httpd/apache2 spawning shells, interpreters, curl/wget or netcat. After CVE-2026-119618 exploitation (heap corruption in mod_http2 assign_headers()), attacker code runs with web server privileges, so anomalous child processes of httpd are the primary post-exploitation behavioural indicator; flags reverse-shell, download and metadata-query command lines.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1059, T1203, T1105, T1505.003
• Data sources: sysmon_for_linux, microsoft_defender_for_endpoint_linux, linux_auditd
• Severity: critical
• Confidence: high

Splunk SPL

earliest=-24h index=linux sourcetype="sysmon:linux" EventCode=1 ParentImage IN ("*/httpd","*/apache2","*/httpd.worker") Image IN ("*/sh","*/bash","*/dash","*/zsh","*/curl","*/wget","*/nc","*/ncat","*/python*","*/perl","*/busybox")
```httpd/apache2 spawning a shell, downloader or netcat - post-exploitation of CVE-2026-119618 RCE inherits web server privileges```
| eval suspicious_cmd=if(match(CommandLine,"(?i)((curl|wget) .*(http|ftp))|/dev/tcp/|base64 +-d|chmod +[+]x|mkfifo|nc +-e|169[.]254[.]169[.]254"),1,0)
| stats count AS exec_count max(suspicious_cmd) AS suspicious_cmd min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS command_lines BY host User ParentImage Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host User ParentImage Image suspicious_cmd exec_count first_seen last_seen command_lines

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("httpd", "apache2", "httpd.worker")
| where FileName in~ ("sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "busybox")
| extend SuspiciousCmd = ProcessCommandLine matches regex @"(?i)((curl|wget) .*(http|ftp))|/dev/tcp/|base64 +-d|chmod +[+]x|mkfifo|nc +-e|169[.]254[.]169[.]254"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SuspiciousCmd
| order by Timestamp desc

Sigma

title: Apache httpd Spawning Shell or Download Tool After CVE-2026-119618 Exploitation
id: 8c4d2f19-6a7b-4e3c-b5d0-1f9e3a7c2b02
status: experimental
description: Detects the Apache httpd/apache2 web server process spawning an interactive shell, scripting interpreter or download/netcat utility. Successful exploitation of the CVE-2026-119618 mod_http2 heap corruption yields code execution with the web server's privileges, which typically manifests as httpd child processes launching shells or ingress tools (also characteristic of web shell activity).
references:
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1203
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
    - attack.persistence
    - attack.t1505.003
    - cve.2026.119618
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/httpd'
            - '/apache2'
            - '/httpd.worker'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/perl'
            - '/busybox'
            - '/python'
            - '/python3'
    condition: selection_parent and selection_child
falsepositives:
    - CGI scripts or legacy mod_cgi/mod_php applications that legitimately invoke shell wrappers
    - Health-check or deployment hooks launched by the web server
level: high

Known false positives:

• CGI/mod_cgi or mod_php applications that legitimately call shell wrappers
• Deployment, log-rotation or health-check hooks launched by the web server

Tuning notes: Allow-list known CGI script paths and service accounts by CommandLine. Add additional child binaries relevant to your estate (socat, openssl, php-cli). Requires process telemetry from Sysmon for Linux, auditd execve with ppid enrichment, or MDE for Linux. Keep httpd parent names aligned with your distribution (httpd on RHEL, apache2 on Debian/Ubuntu).

• 🔒 CVE-2026-119618 Apache mod_http2 Exploitation — httpd Worker Crash Burst (Sentinel KQL) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 Post-Exploitation — httpd Spawning Shell or Download Tool (Sentinel KQL) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 C2 / Lateral Movement — httpd Egress to Metadata or Remote Services (Sentinel KQL) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 Exploitation — httpd Worker Crash Burst (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 Post-Exploitation — httpd Spawning Shell or Download Tool (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 C2 / Lateral Movement — httpd Egress to Metadata or Remote Services (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 Exploitation — httpd Worker Crash Burst (Splunk SPL) · unlock with TL Creds
• 🔒 CVE-2026-119618 Apache mod_http2 C2 / Lateral Movement — httpd Egress to Metadata or Remote Services (Splunk SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5797.

Sample indicators (1 of 11)

• File hash: 824beab9b9424d6cfb29595248fdbf6c3dddeab1

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-119618 is rated Critical by the Apache HTTP Server Project, which titles it 'mod_http2: heap corruption and RCE in assign_headers' and describes it as 'Concurrent Execution using Shared Resource with Improper Synchronization' (CWE-362). The flaw sits in the assign_headers() function of the HTTP/2 module. Threads that share resources are not properly synchronized, so concurrent HTTP/2 processing can corrupt heap memory. A remote attacker needs no authentication and can potentially execute arbitrary commands with the privileges of the web server process.

Affected versions are Apache HTTP Server 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub 2.0.8 through 2.0.42. Apache fixed it in 2.4.71, released 2026-11-11 (commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1). Public sources disagree on the patched standalone mod_h2 version: the Wiz table lists 2.0.24 and newer, while its remediation text says to upgrade beyond 2.0.42. Verify against upstream release notes. The Wiz article body also carries a conflicting identifier, CVE-2026-111497, which the Apache advisory does not support; CVE-2026-119618 is the identifier on the Apache page.

The issue was found independently by Anthropic's OSS Scanner (report ANT-2026-MAPKT6MZ, reported 2026-10-26) and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (reported 2026-11-03). No CVSS score is published in the sources reviewed. Wiz reports that 64% of cloud environments contain vulnerable resources and 51% have publicly exposed instances (configuration not accounted for). In cloud settings, Wiz notes that a compromised instance could enable lateral movement to adjacent microservices or cloud metadata endpoints.

No exploit, PoC, IOCs, or threat actor attribution is available. This is a pre-exploitation, patch-priority threat. It follows several other 2026 mod_http2 memory-safety fixes (CVE-2026-23918, CVE-2026-48913, CVE-2026-57941), showing sustained attention on this module. Workaround if patching is not possible: disable HTTP/2 by setting 'Protocols http/1.1' and removing h2/h2c references.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Remediation

Patches

• Apache HTTP Server 2.4.71 (commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1)
• Standalone mod_h2: upgrade beyond 2.0.42 (source inconsistent; verify upstream release notes)

Immediate actions

• Upgrade Apache HTTP Server to 2.4.71 or later
• Inventory internet-facing httpd instances running 2.4.55 through 2.4.70 with mod_http2 loaded (h2/h2c in Protocols)

Workarounds

• Disable HTTP/2: set 'Protocols http/1.1' and remove h2 and h2c references from the configuration

Longer-term hardening

• Track Apache httpd security advisories and patch mod_http2 promptly given repeated 2026 memory-safety fixes
• Run httpd under a least-privilege account and restrict access from web tier to cloud metadata endpoints and adjacent microservices

Affected and fixed versions

• Apache Software Foundation — Apache HTTP Server (mod_http2)
  Vulnerable versions: 2.4.55 through 2.4.70
  Fixed in: 2.4.71 and later
• icing / mod_h2 project (GitHub) — mod_h2 (standalone)
  Vulnerable versions: 2.0.8 through 2.0.42
  Fixed in: Newer than 2.0.42 (Wiz table lists 2.0.24+; source inconsistent)

Timeline

• 2026-05-04 Apache 2.4.67 fixes CVE-2026-23918, a mod_http2 double free with possible RCE (affects 2.4.66 only), a separate earlier mod_http2 flaw.
• 2026-10-01 Apache 2.4.69 fixes CVE-2026-57941, a mod_http2 use-after-free via shared session->bbtmp re-entrancy.
• 2026-10-26 Anthropic's OSS Scanner (ANT-2026-MAPKT6MZ) reports the assign_headers() heap corruption/RCE flaw to the Apache HTTP Server Project.
• 2026-11-03 Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently report the same flaw.
• 2026-11-11 Wiz publishes its analysis: 64% of cloud environments have vulnerable resources and 51% have publicly exposed instances; no exploit or in-the-wild exploitation reported.
• 2026-11-11 Apache HTTP Server 2.4.71 released fixing CVE-2026-119618 (commit locked-ioc-1), rated Critical.

Sources cited

• Apache HTTP Server 2.4 vulnerabilities (fixed in 2.4.71) httpd.apache.org · Advisory · 2026-11-11
• Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know (Wiz Blog) Wiz · Vendor report · 2026-11-11
• Use After Free in Apache HTTP Server mod_http2 via shared session->bbtmp re-entrancy, CVE-2026-57941 (Rapid7) Rapid7 · Research · 2026-10-01
• Red Hat CVE-2026-57941 (related mod_http2 flaw) access.redhat.com · Vendor report · 2026-10-01
• HTTP/2 Bomb: why Apache httpd users should update mod_http2 codeit.guru · Blog · 2026-06-08
• Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE (related mod_http2 flaw) securityaffairs.com · News · 2026-05-04

More in vulnerability

• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)

Related coverage of this activity

• Apache mod_http2 double free