If your website runs on Apache, this week brings one update worth doing soon. On November 11, 2026, the Apache Software Foundation released Apache HTTP Server 2.4.71, which fixes a critical flaw in the HTTP/2 module. The good news is that the fix is already out, and for most people the job is one update and a quick check.

What was fixed

The flaw is tracked as CVE-2026-119618. According to the official Apache security page, it is a race condition in mod_http2, in a function called assign_headers(). Two parts of the code can touch the same data at the same time without proper coordination, which can corrupt memory on the server. In the worst case, an unauthenticated attacker could run code with the web server's privileges.

Apache rates it Critical. Both Apache's own page and BleepingComputer's report list the same affected range: Apache HTTP Server 2.4.55 through 2.4.70, plus the standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42.

The same release also fixes CVE-2026-106023, a crash bug in mod_md rated Important, and a low-severity issue in mod_vhost_alias.

Who should pay attention

Three groups of people are most likely to be affected:

  • Anyone who manages their own VPS or dedicated server running Apache.
  • Agencies and developers who look after client servers.
  • Site owners on managed hosting, who should simply ask their host whether the server has been updated.

BleepingComputer, citing Wiz telemetry, notes that HTTP/2 has to be enabled for the flaw to matter, and that it is not on by default. At the same time, Wiz found vulnerable resources in 64% of the cloud environments it looks at, and about half of those had publicly exposed instances. Those numbers do not account for configuration, so your own setup may be safer than the average. The only way to know is to check.

As of the reports published on November 12, Wiz said it was not aware of public exploits or attacks. That can change, which is a good reason to act early rather than wait.

What to do

  1. Check your version. Run apachectl -v or httpd -v. If it shows something between 2.4.55 and 2.4.70, you need the update.
  2. Update to 2.4.71 or later. On most Linux systems this means your package manager. If your distribution has not published 2.4.71 yet, look for a backported security fix in its advisories.
  3. Restart Apache after updating, and confirm the new version is running.
  4. If you cannot update today, the security firm watchTowr suggests disabling HTTP/2 until you can. Remove or comment out the h2 entry in your Protocols line, then reload. Your site keeps working over HTTP/1.1, just without the HTTP/2 speed benefits.
  5. If you use standalone mod_h2, move to a fixed release, not only the main Apache package.

Why HTTP/2 keeps showing up in security news

This is not the first HTTP/2 fix of the year. In May, Apache 2.4.67 closed CVE-2026-23918, a double-free bug in mod_http2 with a CVSS score of 8.8. In June, the Node.js project also shipped HTTP/2 fixes in its 2026 security releases.

The pattern makes sense. HTTP/2 is a busy protocol with many streams sharing one connection, so small timing mistakes can matter. As more of the web depends on it, more researchers look at it, and more of the issues they find get fixed. According to Apache's page, this latest bug was found by Anthropic's OSS Scanner and by Google Cloud Vulnerability Research, which shows automated tools and human researchers are both helping here.

For site owners, the lesson is calm and practical: keep the web server itself on a regular update schedule, not only WordPress and plugins.

A short checklist

  • Know which web server and version each of your sites runs.
  • Update Apache to 2.4.71 or later.
  • Restart and verify the version afterwards.
  • Disable HTTP/2 temporarily if an update is not possible yet.
  • Keep a recent backup before any server change.
  • Ask your hosting provider about their patch timing if you are on managed hosting.
  • Re-check your site after the update: homepage, forms, checkout and login.

Server updates are much less stressful when they are routine. If you would like a hand with updates, backups and monitoring, I share more website care tips at expertwebdeveloper.in and growsmartwithai.com.

Also published on

Sources