Security maintenance: Apache HTTP Server vulnerability patched
On November 11, 2026, a critical security vulnerability in Apache HTTP Server was made public: CVE-2026-119618. We checked our infrastructure and found that one of our servers was running an affected version. One day later, on November 12, that server was patched.
What the vulnerability is
Section titled “What the vulnerability is”The issue is a race condition in the HTTP/2 module of Apache HTTP Server. Under the right conditions, a remote attacker could corrupt the server’s memory and run their own code on it, without needing to log in. It affects Apache HTTP Server versions 2.4.55 through 2.4.70 with HTTP/2 enabled, which covers a large share of web servers on the internet.
At the time of the announcement there were no known exploits or reports of attacks using it. That window is exactly when patching matters most.
What we did
Section titled “What we did”- Reviewed the advisory the same day it was published.
- Checked every Claz server and found one running an affected version.
- Upgraded Apache HTTP Server on that server to a fixed version (2.4.71 or later).
- Verified that the site, listings, search and accounts were working normally after the update.
The update was rolled out without downtime.
What this means for you
Section titled “What this means for you”Nothing changes on your side, and there is nothing you need to do. We have no indication that Claz was targeted or that any data was accessed. Your listings and account data are safe.
Keeping Claz secure is ongoing work, and we’ll keep applying critical fixes as quickly as we can when new issues are announced.