Apache fixes HTTP/2 flaw that could enable remote code execution

Apache HTTP Server has been updated to version 2.4.71 on 11 November 2026 to address three security flaws, the most critical being a race condition in the HTTP/2 module that could lead to remote code execution (RCE). The advisory, led by the Apache project, notes that the RCE arises from a concurrent execution issue in mod_http2’s assign_headers() unit, described as a “Concurrent Execution using Shared Resource with Improper Synchronization” vulnerability.

The other two flaws, CVE-2026-106023 and CVE-2026-109163, also affect the HTTP Server and related modules; CVE-2026-106023 is a NULL pointer dereference in mod_md that can crash a server child process, while CVE-2026-109163 is a one-byte stack buffer overwrite in mod_vhost_alias following a prior patch (CVE-2026-63292). The article lists all three as not known to be exploited at the time of reporting, though the potential impact is high given the prevalence of HTTP/2 deployments.

Affected versions are detailed by the article: CVE-2026-119618 impacts 2.4.55 through 2.4.70 (and GitHub mod_h2 builds from 2.0.8 to 2.0.42), CVE-2026-106023 affects 2.4.30 through 2.4.70, and CVE-2026-109163 affects 2.4.69 and 2.4.70. The fix is included in Apache HTTP Server 2.4.71, with administrators urged to upgrade promptly via the official download page or their Linux distribution’s package update. As a temporary mitigation, the article suggests turning off mod_http2 and mod_md if not required.

The report attributes the findings to vendor advisories and external researchers, noting no public exploit code has been observed in the wild at the time, and emphasising the broad scope of Apache deployments and the HTTP/2 security risk.