CVE-2026-119618 (critical): mod_http2: heap corruption and RCE in assign_headers

Support
1

Hi, any updates scheduled for HTTPD?

httpd-devel-2.4.67-2.apnscp.x86_64
httpd-2.4.67-2.apnscp.x86_64

httpd -V
Server version: Apache/2.4.67 (apnscp)
Server built: May 5 2026 15:00:38
Server’s Module Magic Number: 20120211:142
Server loaded: APR 1.7.6, APR-UTIL 1.6.3, PCRE 10.32 2018-09-10
Compiled using: APR 1.7.6, APR-UTIL 1.6.3, PCRE 10.32 2018-09-10
Architecture: 64-bit
Server MPM: event
threaded: yes (fixed thread count)
forked: yes (variable process count)
Server compiled with…
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_PROC_PTHREAD_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=256
-D HTTPD_ROOT=“/usr”
-D SUEXEC_BIN=“/usr/sbin/suexec”
-D DEFAULT_PIDLOG=“/var/run/httpd.pid”
-D DEFAULT_SCOREBOARD=“logs/apache_runtime_status”
-D DEFAULT_ERRORLOG=“logs/error_log”
-D AP_TYPES_CONFIG_FILE=“/etc/httpd/conf/mime.types”
-D SERVER_CONFIG_FILE=“/etc/httpd/conf/httpd.conf”

https://nvd.nist.gov/vuln/detail/cve-2026-119618

2

Released this morning.

3

??? didn´t understand. What is released?
Didn´t have any updates

cpcmd misc:cp_version
revision: b08d5efe51ae62c775f56b3622463535689d1e9c
timestamp: 1793344042
ver_maj: 3
ver_min: 2
ver_patch: 49
ver_pre: ''
dirty: false
checksum: 13528f8d75c1bed
debug: false



 upcp 
Updating to v3.2.49.2
HEAD is now at b08d5efe5 FIX: sticky-bit requires explicit leading octal indicator to avoid dec -> oct conversion (php/build-from-source)
Compiled services and packages files removed!
Nothing to migrate.
Nothing to migrate.
Upgrade requested, but old = new (b08d5efe51ae62c775f56b3622463535689d1e9c)
4 
dnf clean all
dnf update -y
rpm -q --queryformat="%{VERSION} %{INSTALLTIME:date}\n" httpd

RPMs are delivered through yum/dnf. upcp concerns itself with platform code updates. These updates are automatically picked up throughout the day.