apache-http-server

Apache 2.4.71 closes an HTTP/2 remote code execution race

CVE-2026-119618 is a critical HTTP/2 race condition in Apache mod_http2 that allows unauthenticated remote code execution; patch to 2.4.71 or disable HTTP/2.