#http2

CVE-2026-119618: Apache httpd 2.4.71 fixes critical mod_http2 RCE flaw

Apache HTTP Server 2.4.55 to 2.4.70 are affected by a critical mod_http2 race condition that can lead to remote code execution; 2.4.71, released 11 November 2026, fixes it.