Apache httpd: check your version and keep it patched

Updated November 2026

Apache httpd 2.4 is the only supported branch. The latest release is 2.4.69 from October 1, 2026, which fixed 20 CVEs. Update the distribution package (or the project build you use), run a config test, and do a full restart so the new code loads.

2.4.69Latest release (October 1, 2026)
20CVEs fixed in 2.4.69 (5 moderate, 15 low)
13CVEs fixed in 2.4.68 (June 8, 2026)
2017Last 2.2 release; 2.2 is end of life

What Apache httpd is

The Apache HTTP Server ("httpd") is a general-purpose web server, often used with PHP, as a reverse proxy, and by control panels on shared hosting. Its features come as modules, and most security bugs sit in optional ones. Knowing which modules you load tells you how urgent each advisory is for you. The package and service name differ by system: apache2 on Debian, Ubuntu, SUSE and Alpine, httpd on the RHEL family, and apache24 on FreeBSD. For the shared web-server routine, see patching web servers.

Check the installed version

apache2ctl -v              # Debian, Ubuntu
httpd -v                   # RHEL family, Alpine, FreeBSD
apachectl -v               # SUSE
apache2ctl -M              # loaded modules (httpd -M on RHEL, Alpine, FreeBSD)
apache2ctl -V | grep -i mpm   # which MPM: event, worker or prefork

Then check which package and repository supplied it:

apt policy apache2                 # Debian, Ubuntu
rpm -q httpd mod_ssl mod_http2     # RHEL family
rpm -q apache2                     # SUSE
apk policy apache2                 # Alpine
pkg info apache24                  # FreeBSD
docker exec web httpd -v           # official httpd image, container "web"

Supported versions

Apache httpd branches, as of November 2026
Branch	Latest	Status
2.4	2.4.69 (Oct 1, 2026)	Supported; the only maintained branch
2.2	2.2.34 (July 2017)	End of life; no security updates
2.0, 1.3	–	End of life

The project names no end date for 2.4. Fixes ship in new 2.4.x releases, and the download page recommends the latest one over all previous releases. If anything still runs 2.2, which is end of life, treat it as unpatched and plan the move now (see end-of-life software).

The 2.4.69 fixes rated moderate were in mod_dav, mod_dav_fs, mod_http2 (a use-after-free, CVE-2026-57941), mod_vhost_alias, and directory handling on case-insensitive file systems. The low-rated ones touch modules such as mod_auth_digest, mod_proxy_ftp, mod_proxy_uwsgi, mod_userdir, mod_session and mod_ssl's SSLRequire in .htaccess files. 2.4.68 included a privilege escalation through expressions in .htaccess files (CVE-2026-44119).

Distro packages and backports

Most distributions keep one httpd version per release and backport fixes into it, so apache2ctl -v may show 2.4.58 on a fully patched Ubuntu 24.04. Judge the package version against the distro advisory, not the upstream number. Debian is different: its security updates currently bring new upstream 2.4 releases, such as 2.4.69 on Debian 13.

CVE-2026-57941 (mod_http2) by release, checked November 3, 2026
Release	Current package	Status
Debian 13	2.4.69-1~deb13u1	Fixed (DSA-6569-1)
Debian 12 (LTS)	2.4.68-1~deb12u1	Still listed as vulnerable
Ubuntu 26.04 LTS	2.4.66-2ubuntu2.6	Fixed since 2.4.66-2ubuntu2.5
Ubuntu 24.04 LTS	2.4.58-1ubuntu8.17	Fixed since 2.4.58-1ubuntu8.16
Ubuntu 22.04 LTS	2.4.52-1ubuntu4.25	Fixed since 2.4.52-1ubuntu4.24
Alpine 3.24	2.4.69-r0	Upstream fixed version
FreeBSD ports	2.4.69 (latest), 2.4.68_1 (quarterly)	Fixed only on the latest branch

FreeBSD's pkg uses the quarterly branch by default, which was still on 2.4.68_1. pkg audit -F shows whether that matters for you. Where no fix exists yet, check whether the affected module is loaded at all. If you don't need HTTP/2, disabling mod_http2 removes this flaw (sudo a2dismod http2 on Debian, then restart).

The project's download page offers source tarballs only; ready-made binaries come from distributions and third parties. If you build from source, verify the tarball with the project's KEYS file and the .asc or SHA-512 file before you build.

Update commands

# Debian, Ubuntu
sudo apt update
sudo apt install --only-upgrade apache2 apache2-bin apache2-data apache2-utils

# RHEL, Rocky, AlmaLinux, Oracle Linux (leave out packages rpm -q says are missing)
sudo dnf upgrade --refresh httpd mod_ssl mod_http2

# SUSE
sudo zypper refresh
sudo zypper update apache2

# Alpine (as root)
apk -U upgrade apache2

# FreeBSD (as root)
pkg audit -F
pkg upgrade apache24

# Docker: official image, then recreate the container
docker pull httpd:2.4
docker compose up -d --pull always

The httpd:2.4 image tag currently gives 2.4.69, on Debian trixie or (with -alpine) Alpine 3.24. Rebuild your own images built on it. To install every pending fix at once, see patching fast.

Test, then restart

Run the config test first. A failed test leaves the running server untouched.

sudo apache2ctl configtest && sudo systemctl restart apache2   # Debian, Ubuntu
sudo apachectl configtest && sudo systemctl restart httpd      # RHEL family
sudo apachectl configtest && sudo systemctl restart apache2    # SUSE
httpd -t && rc-service apache2 restart                          # Alpine, as root
service apache24 configtest && service apache24 restart         # FreeBSD, as root

Each of these restarts the service, with a short break in service. A graceful restart (apachectl -k graceful, or systemctl reload) lets running requests finish and re-reads the config. But with it, and with apachectl -k restart, the parent process never exits, so the old binary stays in memory. After a package or OpenSSL update, stop and start the service with systemctl restart as shown. Behind a load balancer, restart one node at a time.

Verify the fix

apache2ctl -v                                   # or httpd -v
ps -o pid,lstart,cmd -C apache2                 # -C httpd on RHEL family
sudo needrestart -r l                           # Debian, Ubuntu: anything still on old files?
sudo dnf needs-restarting -s                    # RHEL family

The parent process should have started after the update. Load the site, check the error log, and compare the package version with the fixed version in your distribution's advisory.

Where advisories appear

Apache httpd 2.4 vulnerabilities: every CVE with severity, affected versions and the release that fixed it.
The announce list, announce@httpd.apache.org: subscribe by mailing announce-subscribe@httpd.apache.org. The project's security page points here for notice of new security fixes. See the mailing lists page.
Report a new flaw privately to the ASF Security Team, as described on the project's security reports page.
Your distribution's tracker for backported fixes, and our vulnerability pages.

Quick hardening tips

Disable modules you don't use: a2dismod on Debian, Ubuntu and SUSE; comment out LoadModule lines in /etc/httpd/conf.modules.d/ on RHEL. Recent CVEs hit mod_dav, mod_userdir, mod_proxy_ftp and mod_auth_digest, among others.
Set AllowOverride None wherever you don't need .htaccess files. Two recent CVEs involved .htaccess.
Set ServerTokens Prod and ServerSignature Off to hide the exact version.
Use Options -Indexes so folders without an index file are not listed.
Restrict /server-status and /server-info to local or admin addresses with Require ip.
Set SSLProtocol -all +TLSv1.2 +TLSv1.3 and keep OpenSSL patched.
Prefer the event MPM with PHP-FPM over mod_php (see updating PHP).
Add TraceEnable Off unless you need HTTP TRACE.