Apache Patches a Critical Web Server Flaw That Goes Back to 2023

The Apache HTTP Server project released version 2.4.71 on Nov. 11, 2026, fixing a flaw in mod_http2, the module that handles HTTP/2 connections. The project rates the flaw critical and says it can lead to remote code execution.

The flaw is listed as CVE-2026-119618 and affects Apache HTTP Server 2.4.55 through 2.4.70, according to the project's advisory, whose release list dates 2.4.55 to January 2023. For anyone running a server in that range, 2.4.71 is the release the project names as carrying the fix. Copies of the module built from its standalone source, published as mod_h2, are affected from 2.0.8 through 2.0.42.

Two more flaws are fixed in the same release, and the project rates both lower. CVE-2026-106023, rated important, is in mod_md, and the advisory says it can crash a server child process; it affects 2.4.30 through 2.4.70. CVE-2026-109163, rated low, is in mod_vhost_alias, and it affects only 2.4.69 and 2.4.70.

For the critical flaw, the project credits two finders who reported separately. It lists Anthropic's OSS Scanner, under a vulnerability identifier of its own, as reporting to the security team on Oct. 26, 2026, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research as reporting on Nov. 3, 2026.

The project's own list of releases that fixed vulnerabilities puts the previous one, 2.4.69, on Oct. 1, 2026, with 20 CVEs.