Critical RCE Vulnerability in Apache HTTP Server

A critical remote code execution vulnerability (CVE-2026-119618) has been discovered in Apache HTTP Server's HTTP/2 module, caused by a race condition in the assign_headers() function that allows unauthenticated attackers to corrupt heap memory and execute arbitrary code. According to Wiz data, 64% of cloud environments contain vulnerable resources, with 51% publicly exposed, posing significant risk for lateral movement and compromise of adjacent services. Security teams should immediately upgrade to Apache HTTP Server version 2.4.71 or mod_h2 2.0.24 and newer, or temporarily disable HTTP/2 support until patching is possible.