# Apache HTTP Server: 2.4.71 fixes a critical HTTP/2 flaw

Canonical: https://www.oktsec.com/radar/apache-http-server-2-4-71
Publisher: Oktsec
Language: en
Published: 2026-11-12T19:04:31Z
Updated: 2026-11-12T19:04:31Z
Record reviewed: 2026-11-12T19:04:31Z
Latest evidence check: 2026-11-12T19:04:31Z
Disclosed: 2026-11-11

Apache released 2.4.71 to correct a race in mod_http2 that can lead to code execution, plus separate errors in mod_md and mod_vhost_alias. Applicability depends on the modules in use.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: Apache rates the mod_http2 issue critical and has released 2.4.71. The primary advisories do not establish exploitation in attacks.
- Evidence: Attacks not established
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Apache Software Foundation
- Products: Apache HTTP Server
- CVEs: CVE-2026-119618, CVE-2026-106023, CVE-2026-109163

## Technical overview

Apache published HTTP Server 2.4.71 on November 11. CVE-2026-119618 is a concurrency error in mod_http2 that can corrupt heap memory and lead to code execution. It affects httpd 2.4.55 through 2.4.70.

The same release corrects CVE-2026-106023 in mod_md, which can crash a child process, and CVE-2026-109163 in mod_vhost_alias, a one byte stack overwrite. Their affected ranges differ and are listed separately. The advisories do not establish attacks exploiting these flaws.

Apache also identifies affected standalone GitHub mod_h2 releases from 2.0.8 through 2.0.42. The httpd fix version does not establish that an independently installed module has been replaced.

Oktsec recommends checking enabled modules, applying the supported correction and confirming the running server after the change. Include reverse proxies and application front ends in that check.

## Recommended response

Identify enabled modules and update Apache HTTP Server to 2.4.71 or a vendor package containing the fixes. Verify the running server and separately installed HTTP/2 modules.

Relevant to: Teams operating Apache HTTP Server, including reverse proxies and application front ends.

## CVE attribution

- CVE-2026-119618: Apache Software Foundation — Apache HTTP Server mod_http2. [Source](https://httpd.apache.org/security/vulnerabilities_24.html)
- CVE-2026-106023: Apache Software Foundation — Apache HTTP Server mod_md. [Source](https://httpd.apache.org/security/vulnerabilities_24.html)
- CVE-2026-109163: Apache Software Foundation — Apache HTTP Server mod_vhost_alias. [Source](https://httpd.apache.org/security/vulnerabilities_24.html)

## Affected systems and fixes

### Apache HTTP Server with mod_http2

Affected: 2.4.55 through 2.4.70; CVE-2026-119618.

Fixed release / action: 2.4.71

### Apache HTTP Server with mod_md

Affected: 2.4.30 through 2.4.70; CVE-2026-106023.

Fixed release / action: 2.4.71

### Apache HTTP Server with mod_vhost_alias

Affected: 2.4.69 and 2.4.70; CVE-2026-109163.

Fixed release / action: 2.4.71

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.10
Checked: 2026-11-12T19:05:11.083Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-12T19:05:11.696Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-119618](https://api.first.org/data/v1/epss?cve=CVE-2026-119618): 0.4% probability of observed exploitation in the next 30 days; percentile 34.55%; score date 2026-11-12.
- [CVE-2026-109163](https://api.first.org/data/v1/epss?cve=CVE-2026-109163): 0.25% probability of observed exploitation in the next 30 days; percentile 16.18%; score date 2026-11-12.
- [CVE-2026-106023](https://api.first.org/data/v1/epss?cve=CVE-2026-106023): 0.3% probability of observed exploitation in the next 30 days; percentile 22.56%; score date 2026-11-12.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-12T19:05:11.696Z.

## Response checklist

1. **Identify the affected modules** — Check Apache versions and whether mod_http2, mod_md or mod_vhost_alias is loaded. Record modules installed independently from the server package.
2. **Apply the supported package correction** — Update to Apache HTTP Server 2.4.71 or a distribution package whose vendor confirms these fixes. Package version numbers can differ when a distributor applies a backport.
3. **Verify the running server** — Oktsec recommends following the vendor restart procedure, confirming the active binary and modules, and testing application traffic after the change.
4. **Check independent HTTP/2 modules** — Apache also lists GitHub mod_h2 2.0.8 through 2.0.42 as affected by CVE-2026-119618. Do not assume an httpd package update replaces a separately installed module; obtain its maintainer’s correction guidance.

## Relevance to AI environments

Include Apache instances serving application APIs and agent tools when checking enabled modules and deployed packages.

## Sources

- [Apache: three module corrections in 2.4.71](https://httpd.apache.org/security/vulnerabilities_24.html) — Apache Software Foundation; Vendor notice; checked 2026-11-12T19:04:31Z
- [Apache HTTP Server 2.4.71 release](https://httpd.apache.org/download.cgi) — Apache Software Foundation; Vendor notice; checked 2026-11-12T19:04:31Z

## Editorial record

- 2026-11-12T19:04:31Z: Added verified affected versions, corrections and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/apache-http-server-2-4-71) · [Build a response plan](https://www.oktsec.com/radar/apache-http-server-2-4-71#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=apache-http-server-2-4-71&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=apache-http-server-2-4-71&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.