Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

slackware SSA:2026-315-03: [slackware-security] httpd (SSA:2026-315-03)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794423962 advisory.

  - Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP     Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55     through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. (CVE-2026-119618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794423962 advisory.

  - Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP     Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55     through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. (CVE-2026-119618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98953 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98954 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98978 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98979 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98968 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98982 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98981 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy     (CVE-2026-57941)

    * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
379104	Rocky Linux 9.6 [TuxCare] Security Update: mod_http2 (ALMALINUX9.6:CLSA-2026:1794423962)	Nessus	Rocky Linux Local Security Checks	Local	critical
379102	AlmaLinux 9.6 [TuxCare] Security Update: mod_http2 (ALMALINUX9.6:CLSA-2026:1794423962)	Nessus	Alma Linux Local Security Checks	Local	critical
379073	RHEL 10 : mod_http2 (RHSA-2026:98953)	Nessus	Red Hat Local Security Checks	Local	critical
379059	RHEL 9 : mod_http2 (RHSA-2026:98954)	Nessus	Red Hat Local Security Checks	Local	critical
378993	RHEL 10 : mod_http2 (RHSA-2026:98978)	Nessus	Red Hat Local Security Checks	Local	critical
378987	RHEL 10 : mod_http2 (RHSA-2026:98979)	Nessus	Red Hat Local Security Checks	Local	critical
378974	RHEL 9 : mod_http2 (RHSA-2026:98968)	Nessus	Red Hat Local Security Checks	Local	critical
378970	RHEL 9 : mod_http2 (RHSA-2026:98982)	Nessus	Red Hat Local Security Checks	Local	critical
378969	RHEL 9 : mod_http2 (RHSA-2026:98981)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-119618

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

critical