The Apache Software Foundation published Apache HTTP Server 2.4.71 on November 11, 2026, to address three security vulnerabilities: one critical, one high risk and one low impact. The most serious, CVE-2026-119618, enables potential remote code execution via the mod_http2 module and makes immediate updating essential for Internet-exposed systems.
Apache HTTP Server vulnerabilities and technical details
The critical issue, CVE-2026-119618, affects the mod_http2 module that handles HTTP/2 connections. It stems from a race condition in the assign_headers() function caused by improperly asynchronous access to a shared resource. Technically, this can lead to heap memory corruption, which in certain scenarios may be exploited to achieve arbitrary code execution. Affected Apache HTTP Server versions are 2.4.55 through 2.4.70. The same flaw also impacts the mod_h2 project releases on GitHub from 2.0.8 through 2.0.42.
The second vulnerability, CVE-2026-106023, is classified as high risk and affects mod_md, the module for automated certificate management. It is a NULL Pointer Dereference that can occur during HTTP request processing and may cause server child processes to crash, resulting in denial‑of‑service conditions. Affected versions include 2.4.30 through 2.4.70.
The third issue, CVE-2026-109163, is a one‑byte stack buffer overflow in mod_vhost_alias. It affects versions 2.4.69 and 2.4.70 and is rated low impact. This vulnerability was found after applying a prior fix for CVE-2026-63292.
Discovery, fixes and recommended action
The critical vulnerability was reported thanks to Anthropic OSS Scanner and researchers Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research team; the reports reached Apache’s security team between 2026-10-26 and 2026-11-03. The issues were fixed in Apache HTTP Server 2.4.71 and in 2.4.x by commit 824beab on 2026-11-11.
All three vulnerabilities are resolved in Apache HTTP Server 2.4.71. System administrators should verify installed versions and schedule the update as soon as possible, particularly for systems using HTTP/2 and those directly accessible from the public Internet.
