Apache HTTP Server 2.4.70 Ships as a Maintenance Release, Wrapping Up a Security-Heavy Year
The new 2.4.x milestone adds no new features but patches crashes, buffer overflows, and edge-case bugs while superseding every earlier release.
Apache just released 2.4.70. Announced today, it's the newest General Availability build in the 2.4.x stable branch. The project doesn't dress it up. In its announcement, it calls 2.4.70 "recommended over all previous releases," a blunt way of saying that if you haven't upgraded yet, now's the time.
This is a bug-fix and hardening release. That's web-speak for "no shiny new features." What you're getting is a tightened-up plumbing job, not a new feature set. Not the most exciting kind of news, but arguably the most useful.
The release notes describe this as "fifteen years of innovation," a nod to the 2.4 line's 2012 launch. Apache itself dates back to 1995, when a crew of webmasters stitched together fixes for the public-domain NCSA httpd daemon. It became the top web server within a year and hasn't stepped aside quietly ever since. Today it runs behind a big chunk of the web, including plenty of intranets and small shops that value maturity over flash.
Head here to the condensed changelog if you want every line. The five modules touched in 2.4.70 tell a simpler story. Eric Covener squashed the mod_authnz_ldap crashes that plagued Windows users in 2.4.69 (PR 70261). Emmanuel Dreyfus and Joe Orton pushed the mod_cgid limits higher for environment variables, URIs, and arguments (PR 70270). Rüdiger Pümml patched a rare integer overflow in mod_substitute (PR 66034). Arturo Bernal did the last two jobs: he stopped mod_cache from stashing a response flagged Vary: * (PR 70289), and he closed a heap buffer overflow in mod_dav_lock's dav_size_indirect() (PR 70298), a spot where the code under-reserved space for a key-length field. Two fixes there, both from Bernal.
Small changes. The kind you only notice when they're missing.
Why the surrounding chaos matters
2.4.70 itself carries no new CVEs. The interesting part is what it sits on top of. The immediately preceding release, 2.4.69, dropped October 1, 2026 and fixed a large batch of vulnerabilities. 2026 has been a particularly busy year for the project.
Recent fixes span a catalog of modern web headaches: a use-after-free in mod_http2 (CVE-2026-57941), digest-auth denial-of-service and a one-time-nonce replay (CVE-2026-48005, CVE-2026-73636), request smuggling through mod_proxy_uwsgi (CVE-2026-63718), and stack overflows in mod_vhost_alias from oversized Host headers (CVE-2026-63292). Older entries still on the board include the path-traversal family rooted in 2.4.49 (CVE-2021-41773) and a CGI environment-variable override from 2025 (CVE-2025-65082).
You don't need to memorize any of that. The practical upshot is simple: 2.4.70 bundles all of this work in one package, so upgrading gets you roughly two years of hardening at once.
Keep in mind that this release also rides along with broader work not listed in its condensed changelog. Fixes touched mod_ssl, mod_cgid, and mod_md, added OpenSSL 4.0 compatibility for mod_md, and introduced a new ListenTCPDeferAccept MPM directive plus millisecond-resolution logging. The project also ported its test suite from the old PERL framework to Python/pytest.
Apache isn't the uncontested leader it once was. As of a W3Techs snapshot from April 2026, it ranks third at roughly 23.7% of all websites, behind nginx and Cloudflare. Netcraft's March 2025 numbers put it at about 17.8% of the busiest million sites. Many deployments now sit behind a reverse proxy or CDN anyway. Still, the LAMP stack persists, and familiarity has real value. A boring, stable server your ops team already knows how to run is worth more on paper than a flashy one.
It's a rather unglamorous release for software that quietly runs a big fraction of the internet. That's the point, though. You don't want fanfare from your web server.
What to check before you upgrade
A few practical details. 2.4.70 requires APR and APR-Util, both at minimum 1.5.x, though some features want the 1.6.x line. If you're using a threaded MPM (anything but Prefork), make sure every module you load is thread-safe, including any libraries they depend on. TLS 1.3 needs httpd 2.4.43 or newer with OpenSSL 1.1.1.
And do verify your downloads. Grab the PGP signatures and SHA checksums, cross-check them against the project's KEYS file, then install. The complete change history lives in CHANGES_2.4; the condensed subset for this release is linked right off the download page.
One last thing if you're still on 2.2: that branch passed end-of-life and gets no more patches. Upgrading to 2.4.70 pulls you off unsupported software and onto the last recommended build.
Head here to download Apache httpd 2.4.70. Source tarballs come in .tar.bz2 and .tar.gz with PGP signatures. The changelog, security summary, and docs all sit just a click away.
