The Apache HTTP Server project released httpd 2.4.71 on 11 November 2026 with fixes for three vulnerabilities: one critical, one important and one low, according to its 2.4 security page. The critical flaw, CVE-2026-119618, is in mod_http2's assign_headers(): Apache describes it as a concurrent execution using shared resource with improper synchronization issue that can lead to remote code execution, titled 'mod_http2: heap corruption and RCE in assign_headers'.

It affects Apache HTTP Server 2.4.55 through 2.4.70 and mod_h2 from GitHub 2.0.8 through 2.0.42. Apache credits Anthropic's OSS Scanner (reported 26 October) and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (reported 3 November). CVE-2026-106023 (important) is a NULL pointer dereference in mod_md during HTTP request processing that leads to a child process crash, affecting 2.4.30 through 2.4.70.

CVE-2026-109163 (low) is a one-byte stack buffer overwrite in mod_vhost_alias, following CVE-2026-63292, affecting 2.4.69 and 2.4.70. The page does not say any of the flaws are exploited. (source: Apache HTTP Server security page)