A critical security vulnerability has been identified in the widely used open-source Apache HTTP Server. Attackers can exploit specially crafted requests to corrupt server memory and execute arbitrary code with the privileges of the web service process. In response, Apache has released version 2.4.71 to address the flaw. Administrators of affected websites are urged to upgrade immediately; those unable to do so temporarily can disable HTTP/2 in their configurations as a workaround. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70, as well as mod_h2 versions 2.0.8 through 2.0.42 distributed separately via GitHub. Any server with HTTP/2 enabled is at risk, and administrators should review both global and per-virtual-host configurations. Additionally, deployments using CDNs or reverse proxies should verify whether the origin server is directly accessible via HTTP/2. The flaw originates from a synchronization issue in the assign_headers() function of mod_http2 when handling shared resources, which can lead to heap memory corruption. Unauthenticated visitors can trigger the exploit, posing a threat to server security. The vulnerability was independently discovered and reported by an AI-based vulnerability scanning project and a research team.