Apache 2.4.71 Fixes a Critical HTTP/2 Flaw

On November 11, 2026, the Apache HTTP Server project released version 2.4.71. It fixes a critical flaw in the HTTP/2 module that can lead to remote code execution on versions 2.4.55 through 2.4.70. It affects sites served by Apache with HTTP/2 enabled.

What we know

  • The release: according to Apache's 2.4 vulnerabilities page, 2.4.71 shipped on November 11, 2026 and fixes three flaws: one critical, one important and one low.
  • The critical one (CVE-2026-119618): it sits in mod_http2, the module that serves pages over HTTP/2. Apache describes improper synchronization between concurrent executions that can corrupt heap memory and lead to remote code execution. It affects 2.4.55 to 2.4.70, plus the standalone mod_h2 module on GitHub, versions 2.0.8 to 2.0.42.
  • Who found it: Apache credits Anthropic's open source scanner, which reported it on October 26, and two Google Cloud researchers, who reported it on November 3. The fix and the release followed on November 11.
  • The important one (CVE-2026-106023): in mod_md, the module that manages certificates automatically. A request can crash a server child process. It affects 2.4.30 to 2.4.70.
  • The low one (CVE-2026-109163): a one-byte overflow in mod_vhost_alias, affecting only 2.4.69 and 2.4.70.
  • What the advisory does not say: Apache does not say the critical flaw is being exploited, and it gives no detail on how it is triggered.

What changes and what doesn't

If you run Apache with HTTP/2, this moves to the top of the list: the fix is out and the flaw is rated critical. Servers older than 2.4.55 are outside the critical flaw's range, but they carry older unpatched flaws and should be updated too.

Sites served only by nginx, LiteSpeed or other servers are not affected, and neither is Apache without the HTTP/2 module loaded. Nothing changes for SEO directly. A compromised server, though, can end up serving injected content or going down, and Google notices both.

How to tell if you're affected

  1. Find out which server runs your site. Open the browser's developer tools (F12), go to Network, reload and look at the `server` header on the first request. Many servers hide it; if it's missing, ask your host.
  2. Check for HTTP/2. In the same tab, turn on the "Protocol" column. `h2` means HTTP/2. If a CDN such as Cloudflare sits in front, that `h2` may belong to the CDN, not to your server.
  3. If you have server access, run `httpd -v` or `apache2 -v`. If the version is between 2.4.55 and 2.4.70 and the `http2` module is loaded (`apachectl -M | grep http2`), update to 2.4.71.
  4. On Debian, Ubuntu, Red Hat and similar systems, the Apache version number may stay the same even when the package includes the fix. Check your distribution's security notice for this CVE and install the package that fixes it.
  5. If you can't update today, turning off HTTP/2 in Apache until you patch removes the path to the critical flaw. The site keeps working over HTTP/1.1, a bit slower.
  6. On shared hosting, it's out of your hands. Ask your host whether its servers run Apache with HTTP/2, which version, and when it will apply 2.4.71 or its distribution's patch.
  7. After updating, restart Apache. The old process keeps running until it is restarted.

Related: Apache 2.4.69 Fixes 20 Flaws: How to Check Your Server

Sources

Updates: if Apache or Linux distributions publish news about this flaw, it will be added here with a link.