Apache HTTP Server Project security vulnerabilities page (2.4)

apache-httpd-security · A · candidate

https://httpd.apache.org/security/vulnerabilities_24.html

vendor-psirtvulnslang: enfetch failures: 0quiet periods: 0last fetch: 2026-11-12

Added 2026-11-12 (S1): the Apache HTTP Server project security page (2.4) is the primary for the most widely deployed web server; `extract` reads it in full with dates, fixed-by commits and release numbers, and the 2026-11-11 critical mod_http2 RCE reached the pipeline only through oss-security and an unscored EUVD row. Candidate: promote to active after 3 contributing runs.

Cited in 1 entry

Citation cadence

Citation days per ISO week (1 weeks of coverage span, total 1).

CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported2026-11-12