In this article
  1. What happened
  2. Who’s affected
  3. What to do now
  4. Updates

Update summary

Per the vendor advisory, PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25 update and Apache HTTP Server 2.4.71, checked .

CVE
CVE-2026-119618, CVE-2026-106023, CVE-2026-109163
Exploited?
Neither the PostgreSQL announcement nor the Apache HTTP Server 2.4 vulnerabilities page reports exploitation. CVE-2026-119618, CVE-2026-106023, CVE-2026-109163 and the PostgreSQL CVEs we checked are not in CISA's Known Exploited Vulnerabilities catalog as of Nov 13, 2026, 12:12 p.m. Manila (UTC+8) (catalog version 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z). NVD lists CVE-2026-119618 as Awaiting Analysis and does not publish a CVSS score for it.

Affected products and updates

Affected products and updates, per the vendor advisory
ProductAffectedUpdateSource
Apache HTTP Server (CVE-2026-119618, critical)Apache HTTP Server 2.4.55 through 2.4.70. Standalone mod_h2 releases from GitHub: 2.0.8 through 2.0.42.Upgrade to Apache HTTP Server 2.4.71, released November 11, 2026.Apache HTTP Server 2.4 vulnerabilities (CVE-2026-119618, fixed in 2.4.71), checked
Apache HTTP Server (CVE-2026-106023, important)Apache HTTP Server 2.4.30 through 2.4.70, per the Apache 2.4 vulnerabilities page.Upgrade to Apache HTTP Server 2.4.71.Apache HTTP Server 2.4 vulnerabilities (CVE-2026-106023, fixed in 2.4.71), checked
Apache HTTP Server (CVE-2026-109163, low)Apache HTTP Server 2.4.69 and 2.4.70.Upgrade to Apache HTTP Server 2.4.71.Apache HTTP Server 2.4 vulnerabilities (CVE-2026-109163, fixed in 2.4.71), checked
PostgreSQL 18, 17, 16, 15 and 14The November 12, 2026 announcement says this update closes 52 security vulnerabilities in all supported versions. The project's security page lists which CVEs apply to which major versions. Fixed versions are 18.7, 17.12, 16.16, 15.20 and 14.25.Install the minor release that matches your major version: 18.7, 17.12, 16.16, 15.20 or 14.25. A dump and reload or pg_upgrade is not required. Stop PostgreSQL, update the binaries, restart, then follow the announcement's post-update steps.PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 released (November 12, 2026), checked

Update checklist

  1. Check the Apache HTTP Server version you are running. The Apache httpd manual documents the -v flag on the httpd program; on some systems the binary is named apache2. Also check any standalone mod_h2 install from GitHub.
  2. If the version is 2.4.55 through 2.4.70, you are in the range Apache lists for critical CVE-2026-119618. Treat internet-exposed servers that have HTTP/2 (mod_http2) enabled first, and upgrade to 2.4.71. The 2.4.71 announcement and the 2.4 vulnerabilities page do not list a workaround.
  3. If the version is 2.4.30 through 2.4.70, you are also in the range Apache lists for important CVE-2026-106023 in mod_md. Versions 2.4.69 and 2.4.70 are the range listed for low CVE-2026-109163 in mod_vhost_alias. 2.4.71 is the release that closes all three.
  4. Check the PostgreSQL version with SELECT version(); (documented in the PostgreSQL function reference). If you use a managed service, use the version the provider shows.
  5. Install the matching minor release: 18.7, 17.12, 16.16, 15.20 or 14.25. The announcement says you may stop PostgreSQL and update its binaries; a dump and reload or pg_upgrade is not required for this minor update.
  6. After the PostgreSQL update, follow the announcement's post-update steps: reindex any GIN index you suspect is corrupted; reindex pg_trgm GiST indexes that use gist_trgm_ops; REINDEX TABLE if you see missing chunk number errors; take a new full backup if you use incremental backups; check partitioned tables for NOT NULL NO INHERIT constraints; and reindex B-tree indexes on bpchar columns declared without a length.
  7. If you are still on PostgreSQL 14, the announcement says 14.25 is the final release and PostgreSQL 14 is now end-of-life. Plan a major upgrade to a still-supported version.

If you can't update yet

  • The Apache HTTP Server 2.4 vulnerabilities page, the 2.4.71 announcement and the 2.4.71 changelog do not list a workaround for CVE-2026-119618. They point users to 2.4.71. We do not add an unofficial workaround.
  • The PostgreSQL announcement does not offer a substitute for installing the new minor release. It says you may stop PostgreSQL and update its binaries, then take the post-update steps it lists.

How to check for compromise

Not confirmed, check the vendor advisory.

Steps: What to do now

Developing story, updated as details confirm.

What happened

On November 11, 2026, Apache released HTTP Server 2.4.71. It fixes critical CVE-2026-119618, a mod_http2 heap corruption flaw that Apache says “can lead to RCE” in 2.4.55 through 2.4.70, plus two lesser CVEs. On November 12, PostgreSQL released 18.7, 17.12, 16.16, 15.20 and 14.25, which the project says “fixes 52 security vulnerabilities and over 140 bugs”; 32 are scored CVSS 8.8. PostgreSQL 14 is now end-of-life. Neither vendor nor CISA’s Known Exploited Vulnerabilities catalog reports exploitation.

Who’s affected

Teams running Apache httpd 2.4.55 through 2.4.70, especially internet-facing servers with HTTP/2 enabled, and anyone running PostgreSQL 14 through 18. On a managed database, check the version your provider shows.

What to do now

  1. Check httpd -v (or apache2 -v) and upgrade internet-facing servers to 2.4.71 first. Apache lists no workaround.
  2. Install the matching PostgreSQL minor release. No dump and reload or pg_upgrade is needed, but do the announcement’s post-update reindex and backup steps.
  3. On PostgreSQL 14, plan a major upgrade.

Use our emergency patch checklist for the order of work, and our news page for more coverage.

Updates

  • Nov 13, 2026, 12:12 p.m. Manila (UTC+8): Initial report. Facts are taken from the PostgreSQL November 12, 2026 announcement and security page, the Apache HTTP Server 2.4.71 announcement, CHANGES_2.4.71 and 2.4 vulnerabilities page, and NVD records for CVE-2026-119618, CVE-2026-106023 and CVE-2026-120139.

Sources & method

Last checked: Nov 13, 2026, 12:12 p.m. Manila (UTC+8). Method: We read the PostgreSQL announcement, security page, versioning policy, 18.7 release notes and CVE-2026-120139 page, and the Apache 2.4.71 announcement, CHANGES_2.4.71, download page and 2.4 vulnerabilities page, at about 12:08–12:12 p.m. Manila (UTC+8). The 52-CVE count is the project’s figure; we also counted 52 identifiers on the announcement list. CVSS v3.1 labels and the 32 scores of 8.8 come from that announcement. Per-version affected ranges come from the PostgreSQL security page and from Apache’s 2.4 vulnerabilities page. NVD records were confirmed through the NVD CVE API 2.0 (the HTML detail pages are a JavaScript app and do not include the record in the first response). For CVE-2026-106023, NVD’s English description says “from 2.4.30 through 2.4.69,” while the same NVD record’s affected-versions field and Apache’s vulnerabilities page say through 2.4.70; we use Apache’s range. We did not use unofficial workarounds. Thumbnail is a reuse-licensed photograph, credited with its license under the picture. No affiliate links. How we work.

Spotted an error? See our corrections policy and tell us.