Apache httpd 2.4.71 fixes a critical mod_http2 race condition that can lead to unauthenticated RCE; only HTTP/2-enabled servers are exposed

official (Apache HTTP Server security page and Red Hat CVE page, Nov 11, 2026); not in CISA KEV and no exploitation reported2026-11-11 3:36 PM ET

Do now: upgrade to 2.4.71 (or your distro's patched package). If you can't yet, remove h2 and h2c from the Protocols directive so the server falls back to HTTP/1.1.
Distro notes (Red Hat): RHEL 9 and 10 ship mod_http2 with a separate allocator per stream, which makes exploitation much harder, so Red Hat rates them Important; RHEL 8 and earlier are not affected.
Also fixed: CVE-2026-106023 (important), a mod_md NULL pointer dereference that crashes child processes (2.4.30 to 2.4.70), and CVE-2026-109163 (low), a 1-byte stack overwrite in mod_vhost_alias (2.4.69 and 2.4.70).
Credit: Apache credits Anthropic's OSS Scanner and Google Cloud Vulnerability Research. watchTowr says it is investigating and calls the issue configuration-specific.