Apache HTTP Server 2.4.71 fixes a critical HTTP/2 flaw: update now
Apache httpd 2.4.71 fixes a critical remote code execution flaw in mod_http2 that affects 2.4.55 through 2.4.70, plus two lower-rated bugs. There is no workaround, so update any Apache server you run.
On this page
The Apache HTTP Server project released version 2.4.71 on 11 November 2026. It fixes three security flaws, and the project rates one of them critical. If you run Apache httpd yourself, or a client's site sits on a server that does, plan the update now. The project gives no workaround for any of the three.
The critical flaw: mod_http2
The serious one is CVE-2026-119618. It sits in mod_http2, the module that lets Apache serve requests over HTTP/2. The project's advisory describes a synchronisation fault in a function called assign_headers() that can corrupt memory and "can lead to RCE", which means remote code execution: someone running their own code on your server.
The advisory lists who is affected:
- Apache HTTP Server 2.4.55 through 2.4.70.
- The separate mod_h2 module from GitHub, releases 2.0.8 through 2.0.42.
The flaw was reported to the Apache security team twice, independently: on 26 October by Anthropic's OSS Scanner, and on 3 November by Google Cloud Vulnerability Research. The fix landed, and 2.4.71 shipped, on 11 November.
The other two fixes
2.4.71 also fixes two lower-rated problems:
- CVE-2026-106023, rated important. A NULL pointer dereference in mod_md, the module that manages TLS certificates over ACME, can crash a child process while a request is handled. It affects 2.4.30 through 2.4.70.
- CVE-2026-109163, rated low. A one-byte stack buffer overwrite in mod_vhost_alias, the module for mass virtual hosting. It affects only 2.4.69 and 2.4.70.
For each of the three, the project's vulnerability page gives the same fix: upgrade to 2.4.71.
What the release asks of you
The project's announcement calls 2.4.71 its latest general release and recommends it "over all previous releases", encouraging users of every earlier version to upgrade. It notes that this release needs the Apache Portable Runtime (APR) and APR-Util at version 1.5.x or later, and that some features need 1.6.x of both.
The announcement also repeats a standing warning: if you use one of the threaded MPMs (anything other than Prefork), every module you load, and the libraries those modules depend on, must be thread-safe.
What it means for your site
- Find out whether you run Apache at all. Many sites sit on managed hosting, a CDN or a platform that does not use Apache, and have nothing to do. If you are not sure, ask your host which web server and version serves your sites.
- Check the version. On a server you manage,
httpd -vorapache2 -vprints it. Anything from 2.4.55 to 2.4.70 is in range for the critical flaw. - Update, then restart. Install 2.4.71, or your operating system's patched package when your distribution publishes one, and restart the service so the new code is the code that runs. Run the version check again afterwards.
- Check for mod_http2. The critical flaw is in the HTTP/2 module. Knowing whether yours is loaded tells you how exposed you have been, but it does not replace the update.
- Tell your clients what you did. If you look after sites for others, a short note that their server was checked and patched is worth sending.
