Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know
Summary
Wiz reports CVE-2026-119618, a critical RCE in Apache HTTP Server's HTTP/2 mod_http2 due to a race condition in assign_headers. The post details affected versions, cloud-risk metrics, and concrete remediation steps, including upgrading to 2.4.71+ or 2.0.24+ for mod_h2, with temporary mitigations such as disabling HTTP/2 if needed. It emphasizes urgency for security teams and provides guidance for SRE/SECOPS on prioritizing patching and validation.