A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).

The Apache Software Foundation has fixed the issue, now tracked as CVE-2026–119618, but a significant number of servers are vulnerable and reachable over the public internet.

Discovered by Anthropic’s OSS Scanner and Google Cloud’s Vulnerability Research teams, the vulnerability is a race condition in the mod_http2 module that can corrupt heap memory.