CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

A remote code execution vulnerability was discovered in the modhttp2 module of the Apache HTTP Server. The flaw is triggered by processing malicious HTTP/2 traffic, leading to memory corruption or an equivalent state that allows for arbitrary code execution. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames to a vulnerable server. Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the httpd process, potentially leading to full system compromise, modification of system configuration, exfiltration of sensitive data, and a total loss of service availability.