The Apache HTTP Server Project has released version 2.4.71, a security update that fixes a critical remote code execution flaw in the web server's HTTP/2 module. The release, published on 11 November 2026, addresses three vulnerabilities, led by CVE-2026-119618, and administrators running affected versions are urged to update immediately.

Apache describes CVE-2026-119618 as a race condition in the mod_http2 module's assign_headers function. Concurrent execution using a shared resource without proper synchronisation can corrupt the heap and lead to remote code execution. The flaw was found by Anthropic's OSS Scanner and reported to the Apache security team on 26 October 2026.

Which versions are affected

The critical flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70, as well as the standalone mod_h2 module from version 2.0.8 through 2.0.42. The update also fixes CVE-2026-109163, a stack overwrite in mod_vhost_alias affecting versions 2.4.69 and 2.4.70, and CVE-2026-106023, a NULL pointer dereference in mod_md that can crash a child process.

Apache HTTP Server is one of the most widely used web servers in the world, powering a large share of public websites, so a remote code execution flaw in its HTTP/2 handling carries serious risk for unpatched systems. An attacker able to trigger the race condition could potentially run code on the server without logging in.

No exploitation reported so far

Neither Apache nor independent security reporting has confirmed any active exploitation of CVE-2026-119618, and no public exploit code has been reported. Even so, the critical rating and the wide deployment of the server make prompt patching the safest course. Operators should upgrade to Apache HTTP Server 2.4.71, which contains fixes for all three flaws, and check that any bundled mod_h2 installations are updated too.