In the popular web server Apache2, there is a security vulnerability that could allow attackers to inject malicious code. The error is hidden in a function of the HTTP/2 module mod_http2, where a memory manipulation could lead to Remote Code Execution (RCE). As security experts note, an exploit is very difficult due to the randomness of memory address allocation integrated in modern operating systems (ASLR).
The security vulnerability listed in the Apache security overview, CVE-2026-119618 (Severity level critical, no CVSS value known), is located in the function "assign_headers()". They found it using Anthropics OSS-Scanner and two employees from Google Cloud Vulnerability Research. Since the vulnerability is hidden in the standardly inactive module mod_http2, only servers are affected that support the HTTP/2 protocol.
Videos by heise
