Apache has announced the release of HTTP Server 2.4.70, a bug-fix and hardening update for its 2.4.x stable branch, addressing various issues without introducing new features. This release fixes crashes in mod_authnz_ldap, buffer overflows in mod_dav_lock, and other edge-case problems in multiple modules, consolidating roughly two years of prior updates. Although it does not carry new vulnerabilities, it builds on a security-heavy year following the previous release, 2.4.69, which addressed significant vulnerabilities. Users are encouraged to upgrade from earlier versions for enhanced stability and security, as 2.4.70 is considered the recommended release over all previous ones
Apache HTTP Server 2.4.70 Released: Bug-Fix Update Supersedes All Earlier 2.4.x Versions
Apache has released HTTP Server 2.4.70, its newest General Availability build in the 2.4.x stable branch, announced today. This is fundamentally a bug-fix and hardening release rather than a feature drop, patching crashes in mod_authnz_ldap, overflows in mod_dav_lock, and edge-case issues across mod_cgid, mod_substitute, and mod_cache. Although it carries no new CVEs, it builds on the security-heavy 2026 cycle led by 2.4.69 and bundles roughly two years of fixes on top of earlier releases.
