Apache HTTP Server 2.4.71 fixes a critical HTTP/2 flaw that can let attackers run code. Patch or turn off h2.
The Apache Software Foundation released httpd 2.4.71 on November 11 to fix CVE-2026-119618, a race condition in mod_http2 that can corrupt memory and lead to remote code execution. Versions 2.4.55 through 2.4.70 with HTTP/2 turned on are exposed. Wiz says 51% of cloud environments it scans have a publicly exposed affected instance.











