Apache 2.4.71 Fixes Critical mod_http2 RCE (CVE-2026-119618): Update Your Server

News · 12 November 2026

The Apache HTTP Server project released Apache 2.4.71 on 11 November 2026. It fixes a critical flaw in mod_http2, the module that serves websites over HTTP/2, that can lead to remote code execution. If you run your own Apache server with HTTP/2 turned on, plan this update today.

What happened

According to the Apache HTTP Server 2.4 security page, 2.4.71 fixes three issues:

• CVE-2026-119618 (critical): a race condition in mod_http2’s assign_headers() can cause heap corruption and remote code execution. It affects Apache 2.4.55 through 2.4.70, and mod_h2 from GitHub 2.0.8 through 2.0.42.
• CVE-2026-106023 (important): a NULL pointer bug in mod_md can crash Apache child processes. It affects 2.4.30 through 2.4.70.
• CVE-2026-109163 (low): a 1-byte stack overwrite in mod_vhost_alias in 2.4.69 and 2.4.70.

The critical bug was reported separately by an AI-based scanner and by Google Cloud Vulnerability Research. Server admins on the DirectAdmin forum flagged the release the same day. Apache’s advisory does not mention any attacks in the wild so far.

What it means for site owners

This bug is in the web server itself, not in WordPress or a plugin, so an up-to-date site can still be exposed if the server’s Apache build is old. On shared hosting, your host updates the web server. On your own VPS, VDS or dedicated server, it’s your job or your control panel’s.

What to do now

1. Check your version. Run httpd -v or apachectl -v. Versions 2.4.55 to 2.4.70 are in the affected range.
2. On cPanel & WHM: run EasyApache 4 updates (/scripts/update-packages or WHM’s update screens) once cPanel publishes the fixed ea-apache24 build, then restart Apache.
3. On DirectAdmin: rebuild Apache with CustomBuild (./build update, then ./build apache) after the 2.4.71 version is available.
4. Other servers: install your distribution’s patched httpd or apache2 package. Some distributions backport fixes without changing the version number, so check their security notice.
5. If you cannot update yet: consider temporarily turning off HTTP/2 by removing h2 from the Protocols line, then restarting Apache. Expect some loss of speed until you update.

# check version
httpd -v

# temporary: serve HTTP/1.1 only until patched
Protocols http/1.1

Need help?

A current cPanel licence keeps your server on supported cPanel & WHM and EasyApache 4 builds that receive security updates like this one. Some server owners also swap Apache for LiteSpeed, a drop-in replacement. Questions? Email support@shohost.com or WhatsApp +91 94880 91432 (9 AM to 12 midnight IST).

Sources: Apache HTTP Server 2.4 vulnerabilities page (11 November 2026); DirectAdmin forum (11 November 2026).