# CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()

> A race condition in assign_headers() in Apache HTTP Server's mod_http2 (improper synchronization of a shared resource) lets a remote, unauthenticated attacker trigger heap corruption that can be leveraged for remote code execution with the web server process's privileges. Fixed in Apache HTTP Server 2.4.71 (2026-11-11); Wiz reports no public exploit and no in-the-wild exploitation at publication.

- **Published:** 2026-11-11T21:37:04Z
- **Last reviewed:** 2026-11-11T21:37:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5797
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5797.png
- **ID:** TL-2026-5797
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)
- **CVEs:** CVE-2026-119618, CVE-2026-23918, CVE-2026-57941

## Description

CVE-2026-119618 is rated Critical by the Apache HTTP Server Project, which titles it 'mod_http2: heap corruption and RCE in assign_headers' and describes it as 'Concurrent Execution using Shared Resource with Improper Synchronization' (CWE-362). The flaw sits in the assign_headers() function of the HTTP/2 module. Threads that share resources are not properly synchronized, so concurrent HTTP/2 processing can corrupt heap memory. A remote attacker needs no authentication and can potentially execute arbitrary commands with the privileges of the web server process.

Affected versions are Apache HTTP Server 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub 2.0.8 through 2.0.42. Apache fixed it in 2.4.71, released 2026-11-11 (commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1). Public sources disagree on the patched standalone mod_h2 version: the Wiz table lists 2.0.24 and newer, while its remediation text says to upgrade beyond 2.0.42. Verify against upstream release notes. The Wiz article body also carries a conflicting identifier, CVE-2026-111497, which the Apache advisory does not support; CVE-2026-119618 is the identifier on the Apache page.

The issue was found independently by Anthropic's OSS Scanner (report ANT-2026-MAPKT6MZ, reported 2026-10-26) and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (reported 2026-11-03). No CVSS score is published in the sources reviewed. Wiz reports that 64% of cloud environments contain vulnerable resources and 51% have publicly exposed instances (configuration not accounted for). In cloud settings, Wiz notes that a compromised instance could enable lateral movement to adjacent microservices or cloud metadata endpoints.

No exploit, PoC, IOCs, or threat actor attribution is available. This is a pre-exploitation, patch-priority threat. It follows several other 2026 mod_http2 memory-safety fixes (CVE-2026-23918, CVE-2026-48913, CVE-2026-57941), showing sustained attention on this module. Workaround if patching is not possible: disable HTTP/2 by setting 'Protocols http/1.1' and removing h2/h2c references.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-119618 Apache mod_http2 Post-Exploitation — httpd Spawning Shell or Download Tool (Splunk SPL)** (`TL-2026-5797-SPL-002`)

Detects Apache httpd/apache2 spawning shells, interpreters, curl/wget or netcat. After CVE-2026-119618 exploitation (heap corruption in mod_http2 assign_headers()), attacker code runs with web server privileges, so anomalous child processes of httpd are the primary post-exploitation behavioural indicator; flags reverse-shell, download and metadata-query command lines.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1059, T1203, T1105, T1505.003
- **Data sources:** sysmon_for_linux, microsoft_defender_for_endpoint_linux, linux_auditd
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
earliest=-24h index=linux sourcetype="sysmon:linux" EventCode=1 ParentImage IN ("*/httpd","*/apache2","*/httpd.worker") Image IN ("*/sh","*/bash","*/dash","*/zsh","*/curl","*/wget","*/nc","*/ncat","*/python*","*/perl","*/busybox")
```httpd/apache2 spawning a shell, downloader or netcat - post-exploitation of CVE-2026-119618 RCE inherits web server privileges```
| eval suspicious_cmd=if(match(CommandLine,"(?i)((curl|wget) .*(http|ftp))|/dev/tcp/|base64 +-d|chmod +[+]x|mkfifo|nc +-e|169[.]254[.]169[.]254"),1,0)
| stats count AS exec_count max(suspicious_cmd) AS suspicious_cmd min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS command_lines BY host User ParentImage Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host User ParentImage Image suspicious_cmd exec_count first_seen last_seen command_lines
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("httpd", "apache2", "httpd.worker")
| where FileName in~ ("sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "busybox")
| extend SuspiciousCmd = ProcessCommandLine matches regex @"(?i)((curl|wget) .*(http|ftp))|/dev/tcp/|base64 +-d|chmod +[+]x|mkfifo|nc +-e|169[.]254[.]169[.]254"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SuspiciousCmd
| order by Timestamp desc
```

### Sigma

```yaml
title: Apache httpd Spawning Shell or Download Tool After CVE-2026-119618 Exploitation
id: 8c4d2f19-6a7b-4e3c-b5d0-1f9e3a7c2b02
status: experimental
description: Detects the Apache httpd/apache2 web server process spawning an interactive shell, scripting interpreter or download/netcat utility. Successful exploitation of the CVE-2026-119618 mod_http2 heap corruption yields code execution with the web server's privileges, which typically manifests as httpd child processes launching shells or ingress tools (also characteristic of web shell activity).
references:
    - https://httpd.apache.org/security/vulnerabilities_24.html
    - https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1203
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
    - attack.persistence
    - attack.t1505.003
    - cve.2026.119618
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/httpd'
            - '/apache2'
            - '/httpd.worker'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/perl'
            - '/busybox'
            - '/python'
            - '/python3'
    condition: selection_parent and selection_child
falsepositives:
    - CGI scripts or legacy mod_cgi/mod_php applications that legitimately invoke shell wrappers
    - Health-check or deployment hooks launched by the web server
level: high

```

**Known false positives:**

- CGI/mod_cgi or mod_php applications that legitimately call shell wrappers
- Deployment, log-rotation or health-check hooks launched by the web server

**Tuning notes:** Allow-list known CGI script paths and service accounts by CommandLine. Add additional child binaries relevant to your estate (socat, openssl, php-cli). Requires process telemetry from Sysmon for Linux, auditd execve with ppid enrichment, or MDE for Linux. Keep httpd parent names aligned with your distribution (httpd on RHEL, apache2 on Debian/Ubuntu).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-119618 Apache mod_http2 Exploitation — httpd Worker Crash Burst (Sentinel KQL) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 Post-Exploitation — httpd Spawning Shell or Download Tool (Sentinel KQL) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 C2 / Lateral Movement — httpd Egress to Metadata or Remote Services (Sentinel KQL) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 Exploitation — httpd Worker Crash Burst (Sigma) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 Post-Exploitation — httpd Spawning Shell or Download Tool (Sigma) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 C2 / Lateral Movement — httpd Egress to Metadata or Remote Services (Sigma) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 Exploitation — httpd Worker Crash Burst (Splunk SPL) (locked: unlock with TL Creds)
- CVE-2026-119618 Apache mod_http2 C2 / Lateral Movement — httpd Egress to Metadata or Remote Services (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- File hash: `824beab9b9424d6cfb29595248fdbf6c3dddeab1`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know (Wiz Blog)](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability)
- [Apache HTTP Server 2.4 vulnerabilities (fixed in 2.4.71)](https://httpd.apache.org/security/vulnerabilities_24.html)
- [Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE (related mod_http2 flaw)](https://securityaffairs.com/191759/security/apache-fixes-critical-http-2-double-free-flaw-cve-2026-23918-enabling-rce.html)
- [Use After Free in Apache HTTP Server mod_http2 via shared session->bbtmp re-entrancy, CVE-2026-57941 (Rapid7)](https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2026-57941/)
- [Red Hat CVE-2026-57941 (related mod_http2 flaw)](https://access.redhat.com/security/cve/CVE-2026-57941)
- [HTTP/2 Bomb: why Apache httpd users should update mod_http2](https://codeit.guru/2026/06/http-2-bomb-why-apache-httpd-users-should-update-mod_http2/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5797