Apache httpd news: current release 2.4.69 and recent changes

Updated November 2026

As of November 2026 the current Apache HTTP Server release is 2.4.69, published on October 1, 2026. It is a security, feature and bug-fix release of the 2.4 branch, the only branch the httpd project still maintains. If you build httpd yourself, move to 2.4.69. If you use your distribution's packages, install its latest security update.

Which version am I running?

Ask the server binary. It prints the version and build date:

apachectl -v

If apachectl is not on your path, call the binary directly: apache2 -v on Debian/Ubuntu, httpd -v on RHEL, AlmaLinux, Rocky Linux and Fedora.

Distribution packages often show an older number such as 2.4.58 or 2.4.66 and can still contain fixes for later CVEs, because Debian, Ubuntu and Red Hat copy (backport) security patches into their own version. Not every fix is backported at once, though. Check the distribution's security tracker before you decide a server is unpatched. The vulnerabilities page explains how.

What the last three releases changed

2.4.69 – October 1, 2026

The httpd security team rates its 20 fixes as 5 moderate and 15 low. The moderate ones are a mod_dav shared-lock overflow, a mod_http2 use-after-free, an out-of-bounds write in path handling on Windows, a mod_vhost_alias stack overflow (only if LimitRequestFieldSize is raised above the default) and a mod_dav_fs integer overflow. The low-rated fixes include several mod_auth_digest problems, a mod_rewrite use-after-free with %{LA-U:…} lookups, mod_proxy_html and mod_charset_lite overflows, and a mod_userdir information leak.

Other changes worth knowing about:

2.4.68 – June 8, 2026

13 CVEs, rated 6 moderate and 7 low. The fixes cover mod_http2 (memory use and a use-after-free when file handles run out), mod_ssl OCSP requests, mod_proxy_ftp, mod_proxy_html, mod_xml2enc, mod_dav_fs, mod_ldap, ProxyPassReverseCookieMap, and privilege escalation through expressions in .htaccess files. New features: mod_ssl and ab support OpenSSL 4.0, and ErrorLogFormat accepts %{m}t for millisecond timestamps.

2.4.67 – May 4, 2026

11 CVEs: 1 important, 2 moderate, 8 low. The important one is CVE-2026-23918, a double free in HTTP/2 handling on an early stream reset that could allow remote code execution. Several fixes concern mod_proxy_ajp, the module used to talk to Tomcat over AJP. The release also updates mod_md to version 2.6.10 and updates mod_http2, and adds HEIC, HEIF and SQLite types to mime.types.

Before you upgrade. Test the new version on a copy of your configuration first: run apachectl configtest, then reload. Read the CHANGES file for modules you use, especially mod_auth_digest users after 2.4.69.

Project and ASF news

More background: how the ASF works.

All news pages

Sources