Do Son 
TL;DR
The Apache project released version 2.4.71 of Apache HTTP Server on November 11, 2026, to fix three security bugs. Led by a critical race bug in the HTTP/2 module (CVE-2026-119618), the flaws allow remote code execution and server crashes. Admins must update their web servers to version 2.4.71 right away.
- Product: Apache Software Foundation Apache HTTP Server
- Vulnerabilities: 3 flaws (CVE-2026-106023, CVE-2026-109163, CVE-2026-119618)
- Highest severity: Awaiting analysis
- Worst impact: mod_md NULL pointer dereference leads to child process crash
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | Type | Status |
|---|---|---|
| CVE-2026-106023 | CWE-476 | Not exploited |
| CVE-2026-109163 | CWE-121 | Not exploited |
| CVE-2026-119618 | CWE-362 | Not exploited |
Why It Matters
Apache HTTP Server runs millions of public websites, reverse proxies, and app gateways around the world. Because most web hosts turn on HTTP/2, a remote code execution flaw in this module puts servers at high risk.
Anthropic’s OSS Scanner found the HTTP/2 flaw under ID ANT-2026-MAPKT6MZ. Google Cloud analysts Anthony Weems and Simon Scannell also reported the bug. Currently, neither source reports any active attacks in the wild or public exploit code for these three flaws. While exact version counts remain private, surveys show that Apache serves roughly 20 percent of all active websites globally.
How the Attack Works
HTTP/2 Race Condition and Module Crashes
First, CVE-2026-119618 (Critical) sits inside the HTTP/2 module. As the vendor advisory states, “Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.” Consequently, concurrent requests can corrupt heap memory and let a remote attacker run arbitrary code.
Second, CVE-2026-106023 (Important) hits the ACME cert module during request handling. The report notes that a “NULL pointer dereference vulnerability in Apache HTTP Server’s mod_md” crashes the server child process. Finally, CVE-2026-109163 (Low) is a one-byte stack buffer overwrite in mod_vhost_alias after the earlier CVE-2026-63292 patch.
Affected Versions
The critical HTTP/2 bug (CVE-2026-119618) hits Apache HTTP Server versions 2.4.55 through 2.4.70. It also affects GitHub mod_h2 builds from 2.0.8 through 2.0.42. Meanwhile, CVE-2026-106023 affects versions 2.4.30 through 2.4.70, and CVE-2026-109163 hits versions 2.4.69 and 2.4.70.
Patch and Mitigation Steps
Devs fixed all three bugs in Apache HTTP Server 2.4.71. Admins should get the new build from the official Apache HTTP Server download page right away. They can also install their Linux package update as soon as it arrives. If teams cannot patch now, they should turn off mod_http2 and mod_md if those modules are not needed.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
