# Apache HTTP Server flaw could let unauthenticated attackers execute code

_Published Wednesday, November 11, 2026 at 11:06 PM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

![Apache HTTP Server flaw could let unauthenticated attackers execute code — Primary](https://www.datocms-assets.com/75231/1794425853-threat-update-kics-alert_custom.jpeg?fm=webp)

A vulnerability in Apache HTTP Server's HTTP/2 module could allow remote attackers to execute code without authentication, Wiz reported. The flaw, CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70; version 2.4.71 fixes it.

The vulnerability arises when concurrent threads improperly share resources in the assign_headers() function, potentially corrupting heap memory. Successful exploitation would let an attacker run commands with the web server process's privileges.

Wiz advises upgrading affected installations or temporarily disabling HTTP/2 support. At publication, it reported no available exploit and no reports of exploitation in the wild.

## Sources

- [wiz.io](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability)

---
Canonical: https://techandbusiness.org/newswire/9O5amuVw3RsEc2i_nl7ta9
Published: 2026-11-12T04:06:10.118Z
Story chronology: 2026-11-11T19:49:10.000Z
Retrieved: 2026-11-12T06:55:17.043Z
Publisher: Tech & Business (techandbusiness.org)