Apache HTTP Server 2.4.71 patches critical remote code execution flaw
Original title: Apache HTTP Server Patches Critical RCE Vulnerability Allowing Attackers to Execute Remote Code
The critical flaw affects 2.4.55 through 2.4.70, and Apache cites no evidence of active exploitation.
Apache released HTTP Server 2.4.71 on November 11, 2026, fixing three flaws in modhttp2, modmd and modvhostalias. The critical issue, CVE-2026-119618, is a synchronization flaw in assignheaders() that can corrupt heap memory and potentially allow remote code execution. A high-severity NULL pointer dereference, CVE-2026-106023, can crash a child process, and low-severity CVE-2026-109163 is a one-byte stack overwrite. Anthropic and Google researchers reported the critical bug; the advisory gives no exploit chain or sign of active attacks.
Unconfirmed: Apache does not state authentication requirements or confirm that the remote code execution condition is reachable in default deployments.
- Standalone GitHub modh2 releases 2.0.8 through 2.0.42 are also affected.
- CVE-2026-106023 affects HTTP Server 2.4.30 through 2.4.70.
- CVE-2026-109163 affects only HTTP Server 2.4.69 and 2.4.70.
- Anthropic reported the critical flaw on October 26 and Google on November 3.
Impact: potential remote code execution via heap corruption
| Product | Affected | Fixed in |
|---|---|---|
| Apache HTTP Server | 2.4.55 through 2.4.70 | 2.4.71 |
| Apache modh2 | 2.0.8 through 2.0.42 | — |
| Apache HTTP Server | 2.4.30 through 2.4.70 | 2.4.71 |
| Apache HTTP Server | 2.4.69 and 2.4.70 | 2.4.71 |
- 1.Upgrade affected installations to HTTP Server 2.4.71.
- 2.Verify deployed module versions where modh2 is maintained separately.
- Vendors
- Apache
- Organizations
- AnthropicGoogle Cloud Vulnerability Research
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-119618+1 related CVE | Race condition RCE in Apache HTTP Server mod_http2 | 8.1 group max | <1% | PoC ×9 | |
| CVE-2026-109163 | Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69 | — | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 824beab9b9424d6cfb29595248fdbf6c3dddeab1 | e’s official security advisory records the fix under commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1. The advisory does not provide an exploit chain, authentica |
From the original article
7 min read at gbhackers.com
Apache has released HTTP Server 2. 4. 71 to address three security vulnerabilities, including a critical memory corruption flaw that could enable remote code execution.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.