Apache HTTP Server release history, 1995 to 2026

Updated November 2026

Apache httpd began with release 0.6.2 in April 1995 and reached 1.0 on December 1, 1995. Since then the project has shipped four major branches: 1.3, 2.0, 2.2 and 2.4. Only 2.4 is still maintained. As of November 2026 the newest release is 2.4.69 (October 1, 2026). Every date below was checked against the project's own announcements, CHANGES files or download archive.

Apr 1995First public release, 0.6.2
Dec 1, 1995Apache 1.0
Feb 21, 20122.4.1, first 2.4 GA release
2.4.69Latest release (as of November 2026)

Each bar runs from a branch's first public or GA release to its final release. Overlaps show how long two branches were maintained side by side.

How Apache started

In early 1995 the most widely used web server was NCSA httpd, but its development had stalled. A group of webmasters began pooling their patches for it. By the end of February 1995 eight core contributors formed the Apache Group. Using NCSA httpd 1.3 as the base, they added the published fixes and improvements and released Apache 0.6.2 in April 1995. Robert Thau then designed a new modular architecture, code-named Shambhala, which became Apache 0.8.8 in August 1995. Apache 1.0 followed on December 1, 1995.

Major releases

First releases of each Apache httpd branch
Release	Date	Notes
0.6.2	April 1995	First public release, based on NCSA httpd 1.3
0.8.8	August 1995	New modular server architecture (Shambhala)
1.0	December 1, 1995	First 1.x release
1.3.0	June 1998	Source archive dated June 5, 1998 in the project's release archive
2.0 alpha 1	March 2000	Released at the first ApacheCon, Orlando, Florida
2.0.35	April 6, 2002	First general availability (GA) release of 2.0
2.2.0	December 1, 2005	First 2.2 release
2.4.1	February 21, 2012	First GA release of 2.4 (there was no 2.4.0 GA release)

The Apache Software Foundation was set up in June 1999 to give the server, and later many other projects, a legal and financial home. See the ASF page.

End of life for 1.3, 2.0 and 2.2

Final releases of retired branches
Branch	Final release	Date	What the project said
1.3	1.3.42	February 3, 2010	Final release; 1.3 "has reached end of life status". Users told to move to 2.2.
2.0	2.0.65	July 10, 2013	"The last 2.0 bug and security fix release."
2.2	2.2.34	July 11, 2017	Final 2.2 maintenance release. Some security patches might appear until December 2017; vulnerability evaluation for 2.2 stopped in January 2018.

Still running 2.2 or older? Those versions have had no fixes for years. Any vulnerability found since 2017 is open on them. Plan the move to 2.4: upgrading from 2.2 to 2.4 covers the configuration changes.

2.4.x releases, 2023 to 2026

The 2.4 branch gets new features as well as fixes, so the last number simply goes up with each release. Not every number becomes a public release: the release archive has no 2.4.0, 2.4.5 or 2.4.8, for example. The "CVEs" column counts vulnerabilities the httpd security team lists as fixed in that release.

Apache httpd 2.4.x releases since January 2023 (dates from announce@httpd.apache.org)
Version	Announced	CVEs fixed	Notes
2.4.55	January 17, 2023	3
2.4.56	March 7, 2023	2
2.4.57	April 6, 2023	0	Bug fixes, including a mod_rewrite regression from 2.4.56; new BCTLS and BNE rewrite flags
2.4.58	October 19, 2023	3
2.4.59	April 4, 2024	3
2.4.60	July 1, 2024	8	Several mod_rewrite and mod_proxy fixes
2.4.61	July 3, 2024	1	Fixed CVE-2024-39884, a 2.4.60 regression that could serve PHP source code with some AddType setups
2.4.62	July 17, 2024	2
2.4.63	January 23, 2025	0	Bug-fix release
2.4.64	July 10, 2025	8
2.4.65	July 23, 2025	1	Fixed CVE-2025-54090: every "RewriteCond expr" evaluated as true in 2.4.64
2.4.66	December 4, 2025	5	New ListenTCPDeferAccept and SSLVHostSNIPolicy directives
2.4.67	May 4, 2026	11	Includes CVE-2026-23918 (important), HTTP/2 double free
2.4.68	June 8, 2026	13	OpenSSL 4.0 support in mod_ssl
2.4.69	October 1, 2026	20	Current release as of November 2026

Two patterns stand out. First, a fix release sometimes follows within days or weeks, as with 2.4.61 and 2.4.65, because a change in the previous release broke real configurations. Second, the number of CVEs per release rose sharply in 2026. Most of the 2026 CVEs are rated low or moderate, but each one is a reason to stay current. The vulnerabilities page lists the important ones.

Which version to run today

As of November 2026 the answer is simple: the latest 2.4 release, or the current httpd package from a supported operating system release. A few facts from the project's own notes help when you plan an upgrade:

httpd 2.4.69 needs APR and APR-Util 1.5 or later; some features need 1.6.
To serve TLS 1.3 with OpenSSL 1.1.1 you need httpd 2.4.43 or newer.
Modules built for 2.2 must be recompiled for 2.4, usually with few or no source changes.
If you use a threaded MPM (event or worker), every module and library you load must be thread-safe.

Check the version you have with apachectl -v; see the news page for what changed in the latest releases.

Where to check dates yourself

Announcements: every release is announced on the announce@httpd.apache.org mailing list, which has a public archive at lists.apache.org.
CHANGES files: CHANGES_2.4 lists every change by release. The older CHANGES_1.3 and CHANGES_2.0 are in the release archive.
Release archive: archive.apache.org/dist/httpd/ keeps every source release, including 1.3, 2.0 and 2.2. File dates there are upload dates and can differ by a day or two from the announcement.

Old Apache Today news about early 2.0 alphas and 1.3 releases is listed in the archive.