Summary
A critical synchronization vulnerability (CVE-2026-119618) in Apache HTTP Server's HTTP/2 module (mod_http2) could lead to arbitrary code execution (RCE).
Sangfor has noted the public disclosure of this vulnerability and has immediately initiated an investigation into its potential impact on Sangfor products and solutions. This notice is issued to confirm that Sangfor is aware of the vulnerability and that the assessment is in progress.
To confirm the impact on your specific deployment, please contact your local Sangfor representative or reach out via the Sangfor Customer Support Portal.
Update History
2026-11-13 V1.0 First release.
Disclaimer
This document does not provide any express, implied, or statutory warranties, including but not limited to warranties of merchantability, fitness, and non-infringement. Under no circumstances shall Sangfor Technologies or its direct or indirect subsidiaries be liable for any damages, including direct, indirect, incidental, or consequential loss of business profits and special damages. You shall assume any legal liability arising from your use of this document in any manner. Sangfor reserves the right to modify or update the content and information of this document at any time.
Any software or service packs referred to on this page is the copyrighted work of Sangfor and/or its suppliers. Except for the purpose of vulnerability fixing, you may not further copy, modify, distribute, publish, license, transfer, sell, or attempt to extract the source code of the software or service pack by decompilation or other means.