Apache httpd security: patching, advisories and hardening

Updated November 2026

Keeping Apache safe is mostly routine work. Install security updates as soon as they appear, for httpd and for everything that runs behind it. Load only the modules you need, and know where the httpd team announces fixes. This section covers each step.

• 2.4.69Current release, 2026-10-01 (as of November 2026)
• 2.4.xThe only branch that still gets security fixes
• 2.2.34Last 2.2 release (July 2017), end of life

Distribution packages or upstream

There are two ways to get Apache httpd, and they are patched differently:

• Distribution packages (apache2 on Debian and Ubuntu, httpd on RHEL, AlmaLinux, Rocky and Fedora). Your distribution's security team fixes them, often by backporting the patch into the version it already ships. You get fixes through the normal update tool, together with the rest of the system. This is the right choice for almost every server.
• Upstream builds (compiled from the source tarball on httpd.apache.org, or a third-party build such as those used on Windows). You must watch the announcements yourself and rebuild for every security release. Nothing updates automatically.

Because of backports, a distribution package can report an older version, such as 2.4.66, and still contain fixes from 2.4.67 or later. Read Vulnerabilities (CVEs) for how to check this on your system.

Where fixes are announced

• The httpd vulnerability list: httpd.apache.org/security/vulnerabilities_24.html lists every security issue fixed in 2.4.x, with the project's severity rating and the version that fixed it.
• The announcements list: announce@httpd.apache.org carries release and security announcements only. Only the project posts, and there is no discussion. To subscribe, send a message to announce-subscribe@httpd.apache.org. The httpd security tips recommend this list to anyone running a build from Apache directly.
• Your distribution: the Debian security tracker and debian-security-announce, Ubuntu Security Notices, Red Hat errata (RHSA), and the equivalent for your system. If you use packages, these are the announcements that matter.
• The application stack: PHP, your CMS and its plugins, Tomcat or whatever runs behind Apache. The httpd documentation itself notes that most compromises come from add-on code, CGI scripts or the operating system, not from httpd.

To report a new vulnerability, use the process on the project's security reports page, which sends it to the ASF security team privately. Do not post it in a public bug report.

Apply an update safely

Check the configuration, install the update, then restart. A full restart (not a graceful reload) makes sure the main process and every module run the new code. A restart drops open connections for a moment, so schedule it if the server is busy.

# Debian, Ubuntu
sudo apt update
sudo apt install --only-upgrade apache2   # also updates apache2-bin and apache2-data
sudo apache2ctl -t
sudo systemctl restart apache2      # restarts the service

# RHEL, AlmaLinux, Rocky, Fedora
sudo dnf upgrade httpd               # also updates mod_ssl and other httpd subpackages
sudo apachectl configtest
sudo systemctl restart httpd        # restarts the service

Then confirm the running version and that the site answers:

apachectl -v
curl -sI https://www.example.com/ | head -1

If you are still on Apache 2.2 or older, no fixes exist for you at all. Plan the move with Upgrade 2.2 to 2.4.

In this section

• Vulnerabilities (CVEs)Key Apache httpd 2.4 CVEs from 2021 to 2026 with the httpd team's severity and fixed-in version, the latest release (2.4.69), and how to check distro backports.
• Hardening checklistHarden Apache httpd 2.4 step by step: ServerTokens, TraceEnable, minimal modules, deny by default, security headers, request limits, permissions and SELinux.
• ModSecurity WAFRun ModSecurity with OWASP CRS 4 on Apache 2.4: project status after Trustwave, v2 vs v3, install on Debian and RHEL, DetectionOnly, paranoia levels, false positives.
• DDoS and bad botsProtect Apache 2.4 from slow clients and floods with mod_reqtimeout, mod_evasive, mod_qos and fail2ban, plus front-end rate limits and rules for bad bots and AI crawlers.
• Hacked site recoveryWhat to do when a site on Apache httpd is hacked: take it offline, preserve logs, find web shells and .htaccess injections, restore, patch and rotate passwords.

Sources

• Apache HTTP Server Project home page (2.4.69 release, 2.2 end of life)
• Security reports, Apache HTTP Server Project
• Apache HTTP Server 2.4 vulnerabilities, Apache HTTP Server Project
• Mailing lists, Apache HTTP Server Project
• Security Tips, Apache HTTP Server 2.4 documentation
• Apache HTTP Server 2.4.69 release announcement, Apache Software Foundation