Apache httpd mod_http2 (2.4.55-2.4.70) races on the connection allocator when assign_headers() writes the synthesised Content-Length: 0 into the shared stream table, corrupting the child heap. Containerised lab, stdlib HTTP/2 PoC, ASan and TSan evidence, 2.4.71 differential, workaround test, 0day sweep.
proof-of-concept http2 poc apache-httpd memory-corruption addresssanitizer security-research vulnerability-research remote-code-execution race-condition cwe-362 heap-corruption containerized-lab cve-2026-119618 mod-http2
-
Updated
Nov 12, 2026 - Python