Bug 2567318 (CVE-2026-119618) - CVE-2026-119618 httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2
Summary: CVE-2026-119618 httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution ...
Keywords:
Status: NEW
Alias: CVE-2026-119618
Deadline: 2026-11-12
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-05 14:34 UTC by OSIDB Bzimport
Modified: 2026-11-11 14:54 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:98953 0 None None None 2026-11-11 13:46:22 UTC
Red Hat Product Errata RHSA-2026:98954 0 None None None 2026-11-11 14:16:13 UTC
Red Hat Product Errata RHSA-2026:98968 0 None None None 2026-11-11 14:15:19 UTC
Red Hat Product Errata RHSA-2026:98978 0 None None None 2026-11-11 14:09:56 UTC
Red Hat Product Errata RHSA-2026:98979 0 None None None 2026-11-11 14:33:37 UTC
Red Hat Product Errata RHSA-2026:98981 0 None None None 2026-11-11 14:32:17 UTC
Red Hat Product Errata RHSA-2026:98982 0 None None None 2026-11-11 14:54:19 UTC

Description OSIDB Bzimport 2026-11-05 14:34:18 UTC 
A remote code execution vulnerability was discovered in the mod_http2 module of the Apache HTTP Server. The flaw is triggered by processing malicious HTTP/2 traffic, leading to memory corruption or an equivalent state that allows for arbitrary code execution. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames to a vulnerable server. Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the httpd process, potentially leading to full system compromise, modification of system configuration, exfiltration of sensitive data, and a total loss of service availability.
Comment 4 errata-xmlrpc 2026-11-11 13:46:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:98953 https://access.redhat.com/errata/RHSA-2026:98953
Comment 5 errata-xmlrpc 2026-11-11 14:09:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:98978 https://access.redhat.com/errata/RHSA-2026:98978
Comment 6 errata-xmlrpc 2026-11-11 14:15:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:98968 https://access.redhat.com/errata/RHSA-2026:98968
Comment 7 errata-xmlrpc 2026-11-11 14:16:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:98954 https://access.redhat.com/errata/RHSA-2026:98954
Comment 8 errata-xmlrpc 2026-11-11 14:32:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98981 https://access.redhat.com/errata/RHSA-2026:98981
Comment 9 errata-xmlrpc 2026-11-11 14:33:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.2 Extended Update Support

Via RHSA-2026:98979 https://access.redhat.com/errata/RHSA-2026:98979
Comment 10 errata-xmlrpc 2026-11-11 14:54:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.8 Extended Update Support

Via RHSA-2026:98982 https://access.redhat.com/errata/RHSA-2026:98982
Note You need to log in before you can comment on or make changes to this bug.