The Apache HTTP Server Project released httpd 2.4.71 on 11 November 2026. It fixes three vulnerabilities, one rated critical by Apache.
CVE-2026-119618 (critical) is a race condition in the assign_headers() function of mod_http2, the module that serves HTTP/2. Apache says it causes heap corruption and "can lead to RCE" (remote code execution). It affects httpd 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub from 2.0.8 through 2.0.42. Apache credits Anthropic's OSS Scanner, which reported it on 26 October, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it on 3 November.
The release also fixes CVE-2026-106023 (important), a NULL pointer dereference in mod_md, the module that gets certificates through ACME (for example from Let's Encrypt), which can crash a server child process (2.4.30 through 2.4.70), and CVE-2026-109163 (low), a one-byte stack overwrite in mod_vhost_alias left over after an earlier fix (2.4.69 and 2.4.70 only).
No exploitation in the wild or public exploit code has been reported, and NVD has not scored the flaws yet. Linux distributions will ship the fix in their own packages; until then, check whether your server has HTTP/2 turned on.
