Bug 2567318 (CVE-2026-119618)

Summary:	CVE-2026-119618 httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	csutherl, gchristo, jclere, pjindal, plodge, rhel-process-autobot, security-response-team, szappis, vchlup, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the mod_http2 module of the Apache HTTP Server (httpd), the standard web server used across Red Hat Enterprise Linux and other products. HTTP/2 allows a client to send many requests at the same time over a single connection, and the module handles these concurrent requests using multiple threads. Due to a thread-safety flaw, one thread can modify memory that belongs to another thread, corrupting the server's internal memory. A remote attacker who can reach the web server could exploit this flaw to execute arbitrary commands on the server without any authentication, potentially leading to a complete takeover of the affected system, unauthorized access to sensitive data, and service disruption. Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-11-12

Description OSIDB Bzimport 2026-11-05 14:34:18 UTC

A remote code execution vulnerability was discovered in the mod_http2 module of the Apache HTTP Server. The flaw is triggered by processing malicious HTTP/2 traffic, leading to memory corruption or an equivalent state that allows for arbitrary code execution. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames to a vulnerable server. Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the httpd process, potentially leading to full system compromise, modification of system configuration, exfiltration of sensitive data, and a total loss of service availability.

Comment 4 errata-xmlrpc 2026-11-11 13:46:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:98953 https://access.redhat.com/errata/RHSA-2026:98953

Comment 5 errata-xmlrpc 2026-11-11 14:09:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:98978 https://access.redhat.com/errata/RHSA-2026:98978

Comment 6 errata-xmlrpc 2026-11-11 14:15:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:98968 https://access.redhat.com/errata/RHSA-2026:98968

Comment 7 errata-xmlrpc 2026-11-11 14:16:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:98954 https://access.redhat.com/errata/RHSA-2026:98954

Comment 8 errata-xmlrpc 2026-11-11 14:32:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98981 https://access.redhat.com/errata/RHSA-2026:98981

Comment 9 errata-xmlrpc 2026-11-11 14:33:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.2 Extended Update Support

Via RHSA-2026:98979 https://access.redhat.com/errata/RHSA-2026:98979

Comment 10 errata-xmlrpc 2026-11-11 14:54:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.8 Extended Update Support

Via RHSA-2026:98982 https://access.redhat.com/errata/RHSA-2026:98982