Apache has released HTTP Server 2.4.71, which includes a crucial fix for a critical remote code-execution vulnerability (CVE-2026-119618) in the HTTP/2 module that impacts versions 2.4.55 through 2.4.70. Alongside this major fix, two additional vulnerabilities were addressed: a crash bug in the auto-certificate module and a minor buffer overflow affecting the two most recent releases. The Apache Software Foundation emphasized the urgency of upgrading from older versions, particularly the end-of-life 2.2 branch, to enhance security against increasing threats throughout 2026. Users are advised to ensure their APR and APR-Util versions are up to date and that any third-party modules are thread-safe if using a threaded MPM
Apache HTTP Server 2.4.71 Releases Critical HTTP 2 RCE Fix for Widespread Vulnerabilities
Apache released HTTP Server 2.4.71 today, calling it the best version of the web server they've ever shipped while urging everyone to upgrade. The headline fix is CVE-2026-119618, a critical remote code-execution flaw in the HTTP/2 module that affects anything from 2.4.55 through 2.4.70. Two smaller vulnerabilities also landed, including a crash bug in the auto-certificate module and a one-byte buffer overflow that only hits the two most recent releases. The project has been moving fast all year, so operators are being pushed to patch immediately and migrate off the end-of-life 2.2 branch.
