The Apache HTTP Server project released 2.4.71 on November 11, fixing 3 vulnerabilities: 1 critical, 1 important and 1 low. The worst is CVE-2026-119618: a race condition in assign_headers() in the HTTP/2 module, mod_http2, corrupts heap memory, and Apache states that it can lead to remote code execution. It affects 2.4.55 through 2.4.70 (2.0.8 through 2.0.42 for the separately released mod_h2). The US National Vulnerability Database listed the CVE on November 11 and has not scored it yet; it is not in CISA's KEV catalog and we have seen no reports of exploitation so far. Servers running nginx are not affected.

The three flaws

  • CVE-2026-119618 (critical): the mod_http2 remote code execution described above. According to Apache's record, Anthropic's open-source scanning project reported it on October 26, the Google Cloud Vulnerability Research team reported it independently on November 3, and the fix shipped with 2.4.71 on November 11.
  • CVE-2026-106023 (important): a NULL pointer dereference in mod_md during request processing crashes a child process; it affects 2.4.30 through 2.4.70. mod_md is Apache's module for obtaining and renewing certificates automatically, so it does not matter if you have not enabled it.
  • CVE-2026-109163 (low): a 1-byte stack buffer overwrite in mod_vhost_alias that affects only 2.4.69 and 2.4.70, left over after the fix for CVE-2026-63292 on October 1.

Is your Apache in range

  • Check the version first: apache2 -v on Debian and Ubuntu, usually httpd -v elsewhere. Then run apachectl -M | grep http2 to see whether the http2 module is loaded; no output means HTTP/2 is not enabled.
  • Debian: as of November 12, every package from 2.4.67 to 2.4.69 in Debian 12 and 13 is marked vulnerable, and only unstable has a fixed version set, 2.4.71-1.
  • Ubuntu: USN-9016-1 on November 10 fixed the previous batch of flaws (the 2.4.69 batch), with fixed versions 2.4.52-1ubuntu4.26 on 22.04, 2.4.58-1ubuntu8.18 on 24.04 and 2.4.66-2ubuntu2.7 on 26.04, and it does not include CVE-2026-119618. Going by Apache's range, 2.4.58 on 24.04 and 2.4.66 on 26.04 fall inside the affected versions and 2.4.52 on 22.04 does not; when we wrote this we could not find Ubuntu's own verdict for the CVE, so go by its security page.

What you can do before the patch arrives

Apache's advisory lists no temporary mitigation and simply recommends upgrading to 2.4.71. The vulnerable code is in mod_http2, and requests never reach it when the module is not loaded. So until your distribution ships the patch, a cautious option is to turn HTTP/2 off: on Debian and Ubuntu, run sudo a2dismod http2 && sudo systemctl restart apache2. The site falls back to HTTP/1.1 and keeps working, though pages with many resources will load somewhat slower. After installing the fixed package, turn it back on with sudo a2enmod http2 and restart. If you compiled Apache yourself or installed it through a control panel, you need to upgrade to 2.4.71 yourself or wait for the panel's repository; panel security settings are in our aaPanel installation and security guide.

This is the second time in a month that a mainstream web server has had a serious flaw; the previous one was the 5 flaws nginx fixed on October 14. The mod_md flaw relates to automatic certificate renewal, and certificate setup is covered in our Let's Encrypt SSL tutorial. If the server showed unfamiliar processes or unknown files during this period, follow our intrusion check and hardening guide.