Multiple Vulnerabilities Identified in Apache HTTP Server, Including Critical Remote Code Execution Flaw

Multiple vulnerabilities have been identified in Apache HTTP Server, including a critical race condition (CVE-2026-119618) in the mod_http2 module. This flaw could allow a remote, unauthenticated attacker to corrupt memory and execute arbitrary code on servers with HTTP/2 enabled. Other vulnerabilities include a crash in mod_md (CVE-2026-106023) and a one-byte stack overwrite in mod_vhost_alias (CVE-2026-109163). Users are advised to upgrade to Apache HTTP Server version 2.4.71 or apply vendor-issued fixes.