If you run a website on Apache with HTTP/2 switched on, update to version 2.4.71. The release fixes a critical memory bug in the server’s HTTP/2 module that can lead to remote code execution, and it covers every release from 2.4.55 up to 2.4.70.
The flaw is CVE-2026-119618, in the assign_headers() routine of mod_http2. Apache describes it as shared memory being used without proper synchronisation, which corrupts the heap. It carries Apache’s top rating, “critical”. People who use the standalone mod_h2 module from GitHub are affected too, in releases 2.0.8 through 2.0.42.
Apache’s security page credits two separate finders: Anthropic’s OSS Scanner, which logged the bug under its own internal ID, and Google Cloud Vulnerability Research’s Anthony Weems and Simon Scannell.
The same release closes two smaller holes. CVE-2026-106023 is rated “important”: a request can trigger a NULL pointer dereference in mod_md and crash a child process, and releases back to 2.4.30 have it. The last, CVE-2026-109163, is only rated “low” and concerns a single byte written past a buffer in mod_vhost_alias; only 2.4.69 and 2.4.70 have it.
It is not the module’s first trouble. Apache’s list also holds CVE-2026-57941, a moderate use-after-free in mod_http2, and CVE-2026-23918, an “important” double free on early reset that Apache says could also allow code execution. HTTP/2 handling has been a recurring source of entries, so servers that don’t need the protocol have one less module to worry about.
Admins have been patching Apache often this year. Version 2.4.69 came out in October and 2.4.68 in June, each with its own list of security fixes, and 2.4.71 adds three more. Anyone who updated last month needs to do it again.
