What the history shows
Its vulnerability history includes 1 CVE with a maximum CVSS score of 8.1 and 0 known exploited vulnerabilities, with the latest CVE dated 2026-11-11.
How to stay safe
Operators should remain on supported release lines like 2.4 and avoid end-of-life release lines such as 1.3, 2.0, and 2.2. Always track your installed version to ensure critical security patches are promptly applied.
Check your version
httpd -v || apache2 -vAffected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-119618 | Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers | ≥ 2.4.55 ≤ 2.4.70 | 8.1 | 1.3% | 2026-11-11 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).