Apache httpd 2.4.71 fixes a critical mod_http2 code execution flaw

Apache httpd 2.4.71 fixes a critical mod_http2 code execution flaw

11 November 2026: The Apache Software Foundation has released Apache HTTP Server 2.4.71 to fix CVE-2026-119618, a critical flaw in mod_http2 that can lead to remote code execution, in every release from 2.4.55 through 2.4.70. The project reports no exploitation, and the fix is to upgrade to 2.4.71; two other flaws, one important and one low, are fixed in the same release.

Not yet independently verified. The Apache page gives no CVSS score and says nothing about exploitation; the 9.8 score is Red Hat's, reported by The Hacker News, and we have not read Red Hat's own entry. We will update this when it can be confirmed, and remove this note.

A race in the HTTP/2 header code

The project describes CVE-2026-119618 as "Concurrent Execution using Shared Resource with Improper Synchronization" in the function assign_headers() of mod_http2, which can corrupt the heap and lead to code execution. It affects httpd 2.4.55 through 2.4.70, and the standalone mod_h2 module published on GitHub from 2.0.8 through 2.0.42.

Two teams reported it separately: an automated open-source scanning project on 26 October, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research on 3 November. The fix was committed and 2.4.71 released on 11 November. Red Hat scores it 9.8, according to The Hacker News; the Apache page gives no score of its own.

The other two fixes

• CVE-2026-106023 (important): a NULL pointer dereference in mod_md during request processing crashes a child process. It affects 2.4.30 through 2.4.70, so almost every server that uses mod_md for ACME certificates is in range. It was reported on 29 September.
• CVE-2026-109163 (low): a one-byte stack buffer overwrite in mod_vhost_alias, a follow-up to CVE-2026-63292. It affects only 2.4.69 and 2.4.70.

2.4.71 comes six weeks after 2.4.69, released on 1 October with 20 CVEs, five of them moderate.

Who is exposed, and the stopgap

The critical flaw matters only where HTTP/2 is served by mod_http2, which means the module is loaded and Protocols lists h2 or h2c. A server that speaks only HTTP/1.1, or that sits behind a proxy or load balancer terminating HTTP/2, does not expose this code path to the internet, though the backend should still be upgraded.

Where an immediate upgrade is not possible, removing h2 and h2c from the Protocols directive turns HTTP/2 off until the package arrives. Distributions ship their own builds on their own schedule; the version string of a backported package will not read 2.4.71, so check the distribution's advisory for this CVE rather than the version number.

Anyone who installed mod_h2 from GitHub separately from httpd needs a release later than 2.0.42 as well.

Sources

• Apache HTTP Server 2.4 vulnerabilities: Fixed in Apache HTTP Server 2.4.71, 11 November 2026