Low Severity
CVE-2026-119618
Published: Nov 12, 2026
Apache httpd mod_http2 (2.4.55-2.4.70) races on the connection allocator when assign_headers() writes the synthesised Content-Length: 0 into the shared stream table, corrupting the child heap. Containerised lab, stdlib HTTP/2 PoC, ASan and TSan evidence, 2.4.71 differential, workaround test, 0day sweep.
# CVE-2026-119618 — Apache httpd `mod_http2` heap corruption in `assign_headers()`
| | |
|---|---|
| **CVE** | CVE-2026-119618 |
| **Component** | Apache HTTP Server, module `mod_http2` (standalone `mod_h2`) |
| **Affected** | httpd 2.4.55 – 2.4.70 · mod_h2 2.0.8 – 2.0.42 |
| **Fixed in** | httpd 2.4.71 · mod_h2 2.0.43 |
| **CWE** | CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization |
| **Impact** | Heap corruption in an httpd child process; potential remote code execution |
| **Vector** | Network, unauthenticated, HTTP/2 (cleartext `h2c` or TLS `h2`) |
| **Trigger** | A body-less HTTP/2 request carrying `Content-Type` and no `Content-Length`, with the request header table filled to capacity |
| **Fix commit** | `824beab9b9424d6cfb29595248fdbf6c3dddeab1` (cherry-pick of trunk `5ed39287660daacd1233cb9bbc984b25fa9a4fe3`) |
| **Upstream PR** | apache/httpd#975 → apache/httpd#977, merged 2026-11-09 |
| **Credit** | Anthropic's OSS Scanner (ANT-2026-MAPKT6MZ); Anthony Weems and Simon Scannell, Google Cloud Vulnerability Research |
| **Advisory** | https://httpd.apache.org/security/vulnerabilities_24.html |
| **Workaround** | remove `h2` and `h2c` from the `Protocols` directive |
| **Repository** | https://github.com/googlesky/CVE-2026-119618 |
`mod_http2` gives every HTTP/2 stream a pool of its own, and that pool
inherits the allocator of the connection that owns the session. The
allocator has no mutex: `apr_allocator_create()` does not create one, so
`allocator_lock()` is a no-op for the whole connection. Request processing
is deliberately moved to worker threads with a **private** allocator
(`c2_transit_create()`) precisely so that a worker never touches the
connection's allocator. `assign_headers()` breaks that invariant: for a
body-less request that carries `Content-Type` and no `Content-Length`, the
worker writes the synthesised `Content-Length: 0` into the **shared**
stream table instead of the request-private `r->headers_in`. When