The Apache HTTP Server Project released version 2.4.71 on November 11, 2026, fixing a critical flaw in its HTTP/2 module that can lead to remote code execution. Apache’s security page lists the bug as CVE-2026-119618 and says it affects Apache HTTP Server 2.4.55 through 2.4.70. BleepingComputer reported that an attacker doesn’t need to log in to trigger it.

What’s new

Version 2.4.71 fixes three issues, according to Apache’s advisory:

  • CVE-2026-119618 (critical): heap corruption in mod_http2 that can lead to remote code execution. It also affects mod_h2 from GitHub, versions 2.0.8 through 2.0.42. Apache credits Anthropic’s open source scanner and Google Cloud Vulnerability Research with finding it.
  • CVE-2026-106023 (important): a bug in mod_md, the module that manages SSL certificates, that can crash server processes. It affects 2.4.30 through 2.4.70.
  • CVE-2026-109163 (low): a one-byte overwrite in mod_vhost_alias affecting 2.4.69 and 2.4.70.

Apache’s advisory doesn’t say whether the critical flaw has been used in attacks.

Who it affects

Any website served by Apache with HTTP/2 turned on, which includes many WordPress and small business sites. If you’re on shared or managed hosting and your host uses Apache, the host is responsible for the update. If you run your own VPS or cloud server, the update is your job. Linux distributions often patch older version numbers instead of moving to 2.4.71, so check your distribution’s security notices too.

Our take

Ask your host today whether their Apache servers are on 2.4.71 or a patched distribution package, and get the answer in writing. If you manage your own server, update Apache through your package manager and restart it, then confirm the running version. If you can’t update straight away, turning off HTTP/2 in the Protocols setting removes the vulnerable code path until you can. Sites behind a CDN still need the fix on the origin server.

Apache’s full advisory is on the Apache HTTP Server security page. Our recent post on the OpenSSH flaw covers another server patch worth checking. If server updates aren’t something you want to track yourself, our website maintenance service handles them for you.