Apache HTTP Server 2.4 vulnerabilities fixed by 2.4.71
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-119618, CVE-2026-106023, CVE-2026-109163, Summary: CVE-2026-119618 (critical): mod_http2: heap corruption and RCE in assign_headers ¶ Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2…
EPSS 0.01 CVE-2026-106023 CVE-2026-109163 CVE-2026-119618 CVE-2026-63292 Apache FI