Changelog for apache2-manual-2.4.68-351.1.noarch.rpm :

* Fri Jun 26 2026 Martin Schreiner - update to 2.4.68 Security fixes (all affecting 2.4.x through 2.4.67 unless noted):
* ) CVE-2026-49975: mod_http2 denial of service via memory allocation with excessive size value (2.4.17-2.4.67)
* ) CVE-2026-48913: mod_http2 use-after-free when file handles are already exhausted (2.4.55-2.4.67)
* ) CVE-2026-44186: mod_proxy_ftp infinite loop via an attacker-controlled backend FTP server
* ) CVE-2026-44185: mod_ssl stack buffer over-read in OCSP send_request via an attacker-controlled OCSP server
* ) CVE-2026-44119: escalation of privilege through expressions in .htaccess allowing local authors to read files as the httpd user
* ) CVE-2026-43951: out-of-bounds read in merge_response_headers with mod_headers and mod_mime and multiple response languages
* ) CVE-2026-42536: mod_xml2enc heap-based buffer overflow with untrusted content
* ) CVE-2026-42535: mod_dav_fs path handling allows a WebDAV author to manipulate trusted DAV property databases, crashing child processes
* ) CVE-2026-34356: ProxyPassReverseCookieMap heap-based buffer overflow via malicious backend servers
* ) CVE-2026-34355: mod_proxy_html buffer overflow exploitable by an untrusted backend
* ) CVE-2026-29170: mod_proxy_ftp XSS in HTML directory listing generation
* ) CVE-2026-29167: mod_ldap per-directory use-after-free Non-security changes:
* ) mod_ssl, ab: add support for OpenSSL 4.0
* ) mod_ssl: add SerialNumber as a recognised attribute type for SSL distinguished name variables
* ) mod_ssl: set auth type to \"ClientCert\" when client certificate authentication has been performed
* ) mod_http2: update to 2.0.42; fix excessive file descriptor use for non-TLS frontend connections when sending files
* ) mod_http2: update to 2.0.41; fix cookie header accounting against LimitRequestFields
* ) mod_http2: update to 2.0.40; fix error handling on upload requests when the server runs out of file handles
* ) mod_include: do not print any if/elsif/else content when a conditional evaluation returns an error
* ) mod_dav_fs: return 404 for DELETE if deletion fails because the resource no longer exists
* ) mod_proxy_balancer: include nonce in XML output
* ) mod_proxy_hcheck: honour worker timeout settings
* ) mod_unixd: CoreDumpDirectory requires enabling tracing on FreeBSD 11+
* Thu May 07 2026 Martin Schreiner - Remove last remnants of update-alternatives.
* Wed May 06 2026 Arjen de Korte - version update to 2.4.67
* ) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() [boo#1263950] Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) [boo#1263951] Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB reads in AJP getter functions [boo#1263952] Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line [boo#1263953] HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache crash [boo#1263954] A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
* ) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest timing attack [boo#1263955] A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
* ) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock indirect lock crash [boo#1263956] A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.
* ) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md unrestricted OCSP response [boo#1264150] Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server\'s mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() [boo#1264163] Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr [boo#1263935] An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
* ) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free and possible RCE on early reset [boo#1263957] Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
* ) mod_md: update to version 2.6.10 - Fix issue #420 by ignoring job.json files that claim to have completely finished a certificate renewal, but have not produced the necessary result files.
* ) mod_http2: update to version 2.0.39 Remove streams own memory allocator after reports of memory problems with third party modules.
* ) mod_http2: update to version 2.0.38 Source sync with mod_h2 github repository. No functional change.
* ) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
* ) mod_md: update to version 2.6.7 - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer applied, no matter the configuration.
* ) mod_md: update to version 2.6.9 - Pebble 2.9+ reports another error when terms of service agreement is not set. Treating all \"userActionRequired\" errors as permanent now.
* ) mod_md: update to version 2.6.8 - Fix the ARI related `replaces` property in ACME order creation to only be used when the CA supports ARI and it is enabled in the menu config. - Fix compatibility with APR versions before 1.6.0 which do not have `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
* ) mod_http2: update to version 2.0.37 Prevent double purge of a stream, resulting in a double free. Fixes PR 69899.
* ) mod_md: Use correct function name when compiling against APR < 1.6.0.
* Fri May 01 2026 Martin Schreiner - cgi-bin is disabled by default in modern Apache configurations; creating it unconditionally via tmpfiles.d is unnecessary- Remove /srv/www/cgi-bin from apache2.tmpfiles- Drop %ghost %dir %{cgidir} from %files- Drop %{cgidir} from %check mkdir invocation
* Tue Apr 28 2026 Martin Schreiner - Fix bsc#1262159.- MaxRequestWorkers (256) must be a multiple of ThreadsPerChild (25). Decreased to 250.- use tmpfiles.d for runtime directory creation This improves compatibility with immutable OSs, such as MicroOS.- Add apache2.tmpfiles.- Drop buildroot mkdir calls for log, cache and lib directories: these are now created at runtime via tmpfiles.d- Mark /srv/www, htdocs, cgi-bin, log, cache and lib dirs as %ghost in %files: RPM registers ownership without packaging the paths
* Sun Jan 04 2026 Martin Schreiner - Include a sane HTTPD_SYSCONFIG_FILE env. variable when invoking /usr/sbin/httpd. The appropriate MPM was not being located when calling /usr/sbin/httpd directly.- Rename event\'s \'mod_cgi\' to \'mod_cgid\' in loadmodule.conf, as that\'s what the event MPM ships.
* Thu Dec 04 2025 Arjen de Korte - version update to 2.4.66
* ) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (cve.mitre.org) mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.
* ) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment variable override (cve.mitre.org) Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
* ) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (cve.mitre.org) Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
* ) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (cve.mitre.org) Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd=\"...\" directives. This issue affects Apache HTTP Server before 2.4.66.
* ) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME), unintended retry intervals (cve.mitre.org) An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.
* ) mod_http2: Fix handling of 304 responses from mod_cache.
* ) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of integers, used in push diaries and proxy window size calculations.
* ) mod_md: update to version 2.6.5 - New directive `MDInitialDelay`, controlling how longer to wait after a server restart before checking certificates for renewal. [Michael Kaufmann] - Hardening: when build with OpenSSL older than 1.0.2 or old libressl versions, the parsing of ASN.1 time strings did not do a length check. - Hardening: when reading back OCSP responses stored in the local JSON store, missing \'valid\' key led to uninitialized values, resulting in wrong refresh behaviour.
* ) mod_md: update to version 2.6.6 - Fix a small memory leak when using OpenSSL\'s BIGNUMs. - Fix reuse of curl easy handles by resetting them.
* ) mod_http2: update to version 2.0.35 New directive `H2MaxStreamErrors` to control how much bad behaviour by clients is tolerated before the connection is closed.
* ) mod_proxy_http2: add support for ProxyErrorOverride directive.
* ) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
* ) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual host compatibility policy.
* ) mod_md: update to version 2.6.2 - Fix error retry delay calculation to not already doubling the wait on the first error.
* ) mod_md: update to version 2.6.1 - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty traffic on errored renewals for the ACME CA. This leads to error retries of 30s, 1 minute, 2, 4, etc. up to daily attempts. - Checking that configuring `MDRetryDelay` will result in a positive duration. A delay of 0 is not accepted. - Fix a bug in checking Content-Type of responses from the ACME server. - Added ACME ARI support (rfc9773) to the module. Enabled by default. New directive \"MDRenewViaARI on|off\" for controlling this. - Removing tailscale support. It has not been working for a long time as the company decided to change their APIs. Away with the dead code, documentation and tests. - Fixed a compilation issue with pre-industrial versions of libcurl.- httpd testsuite of svn revision 1929573
* Tue Nov 04 2025 Martin Schreiner - Make /usr/sbin/httpd a dedicated script again, this fixes building modules while still making Apache free of update-alternatives, relying entirely on sysconfig to dispatch the appropriate MPM.
* Fri Oct 31 2025 Dominique Leuenberger - Ensure the mpm subpackages sync their rebuild counter with the main package to have the installations work reliably.
* Tue Oct 21 2025 Martin Schreiner - Re-introduce /usr/sbin/httpd- Links to start_apache2, which now contains the logic to dispatch to the appropriate MPM respecting sysconfig\'s decision.
* Mon Oct 13 2025 Martin Schreiner - Migrate from update-alternatives (bsc#1245830).- The APACHE_MPM environment variable now controls which MPM will be used. If an empty string is provided, the script-helpers file implements its own logic to pick an MPM from the currently installed ones. As at least one MPM is always required, this will work just fine.
* Tue Sep 23 2025 pgajdosAATTsuse.com- httpd testsuite of svn revision 1928711, fixes the failure caused by libxml2 version update to 2.14
* Wed Jul 23 2025 pgajdosAATTsuse.com- version update to 2.4.65
* ) SECURITY: CVE-2025-54090: Apache HTTP Server: \'RewriteCond expr\' always evaluates to true in 2.4.64 (cve.mitre.org) A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\". Users are recommended to upgrade to version 2.4.65, which fixes the issue.
* Fri Jul 18 2025 Martin Schreiner
* Refresh patches: - apache-test-application-xml-type.patch - apache-test-turn-off-variables-in-ssl-var-lookup.patch - apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch - apache2-LimitRequestFieldSize-limits-headers.patch
* Update to 2.4.64.
* CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by Memory Increase
* CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
* CVE-2025-49630: Apache HTTP Server: mod_proxy_http2 denial of service
* CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
* CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
* CVE-2024-43394: Apache HTTP Server: SSRF on Windows due to UNC paths
* CVE-2024-43204: Apache HTTP Server: SSRF with mod_headers setting Content-Type header
* CVE-2024-42516: Apache HTTP Server: HTTP response splitting
* mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer size.
* mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5 builds which enable it in libssl natively.
* mod_asis: Fix the log level of the message AH01236.
* mod_session_dbd: ensure format used with SessionDBDCookieName and SessionDBDCookieName2 are correct.
* mod_headers: \'RequestHeader set|edit|edit_r Content-Type X\' could inadvertently modify the Content-Type _response_ header. Applies to Content-Type only and likely to only affect static file responses.
* mod_ssl: Remove warning over potential uninitialised value for ssl protocol prior to protocol selection.
* mod_proxy: Reuse ProxyRemote connections when possible, like prior to 2.4.59.
* mod_systemd: Add systemd socket activation support.
* mod_systemd: Log the SELinux context at startup if available and enabled.
* mod_http2: update to version 2.0.32 The code setting the connection window size was set wrong, preventing `H2WindowSize` to work.
* mod_http2: update to version 2.0.30- Fixed bug in handling over long response headers. When the 64 KB limit of nghttp2 was exceeded, the request was not reset and the client was left hanging, waiting for it. Now the stream is reset.- Added new directive `H2MaxHeaderBlockLen` to set the limit on response header sizes.- Fixed handling of Timeout vs. KeepAliveTimeout when first request on a connection was reset.
* mod_lua: Fix memory handling in LuaOutputFilter.
* mod_proxy_http2: revert r1912193 for detecting broken backend connections as this interferes with backend selection who a node is unresponsive.
* mod_proxy_balancer: Fix a regression that caused stickysession keys no longer be recognized if they are provided as query parameter in the URL.
* mod_md: update to version 2.5.2- Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified with EC keys before RSA ones.- Fixed missing newlines in the status page output.
* mod_dav: Add API to expose DavBasePath setting.
* mod_md: update to version 2.5.1 - Added support for ACME profiles with new directives MDProfile and MDProfileMandatory. - When installing a custom CA file via `MDCACertificateFile`, also set the libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel (when curl is linked with it) about missing CRL/OCSP in certificates. - Fixed handling of corrupted httpd.json and added test 300_30 for it. File is removed on error and written again. Fixes #369. - Added explanation in log for how to proceed when md_store.json could not be parsed and prevented the server start. - restored fixed to #336 and #337 which got lost in a sync with Apache svn - Add Issue Name/Uris to certificate information in md-status handler - MDomains with static certificate files have MDRenewMode \"manual\", unless \"always\" is configured.
* core: Report invalid Options= argument when parsing AllowOverride directives.
* scoreboard/mod_http2: record durations of HTTP/2 requests.
* Mon Mar 10 2025 Martin Schreiner - Update to 2.4.63:
* mod_dav: Update redirect-carefully example BrowserMatch config to match more recent client versions.
* mod_cache_socache: Fix possible crash on error path.
* mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
* mod_md: update to version 2.4.31 - Improved error reporting when waiting for ACME server to verify domains or finalizing the order fails, e.g. times out. - Increasing the timeouts to wait for ACME server to verify domain names and issue the certificate from 30 seconds to 5 minutes. - Change a log level from error to debug when Stapling is enabled but a certificate carries no OCSP responder URL.
* mod_proxy_balancer: Fix the handling of the stickysession configuration parameter by the balancer manager.
* Add the ldap-search option to mod_authnz_ldap, allowing authorization to be based on arbitrary expressions that do not include the username. Make sure that when ldap searches are too long, we explicitly log the error.
* mod_proxy: Honor parameters of ProxyPassMatch workers with substitution in the host name or port.
* mod_log_config: Fix merging for the \"LogFormat\" directive.
* mod_lua: Make r.ap_auth_type writable.
* mod_md: update to version 2.4.29 - Fixed HTTP-01 challenges to not carry a final newline, as some ACME server fail to ignore it. - Fixed missing label+newline in server-status plain text output when MDStapling is enabled.
* mod_ssl: Restore support for loading PKCS#11 keys via ENGINE without \"SSLCryptoDevice\" configured.
* mod_authnz_ldap: Fix possible memory corruption if the AuthLDAPSubGroupAttribute directive is configured.
* mod_proxy_fcgi: Don\'t re-encode SCRIPT_FILENAME when set via SetHandler.
* mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten URLs, including \"unix:\" ones.
* mod_rewrite: Error out in case a RewriteRule in directory context uses the proxy, but mod_proxy is not loaded.
* http: Remove support for Request-Range header sent by Navigator 2-3 and MSIE 3.
* mod_rewrite: Don\'t require flag to preserve a leading // added by applying the perdir prefix to the substitution.
* Windows: Restore the ability to \"Include\" configuration files on UNC paths.
* mod_proxy: Avoid AH01059 parsing error for SetHandler \"unix:\" URLs in Location (incomplete fix in 2.4.62).
* mod_md: update to version 2.4.28 - When the server starts, it looks for new, staged certificates to activate. If the staged set of files in \'md/staging/\' is messed up, this could prevent further renewals to happen. Now, when the staging set is present, but could not be activated due to an error, purge the whole directory. - Fix certificate retrieval on ACME renewal to not require a \'Location:\' header returned by the ACME CA. This was the way it was done in ACME before it became an IETF standard. Let\'s Encrypt still supports this, but other CAs do not. - Restore compatibility with OpenSSL < 1.1.
* mod_tls: removed the experimental module. It now is availble standalone from https://github.com/icing/mod_tls. The rustls provided API is not stable and does not align with the httpd release cycle.
* mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
* mod_http2: Return connection monitoring to the event MPM when blocking on client updates.
* Tue Jan 14 2025 Dominique Leuenberger - Fix builds of test package with RPM 4.20: + noarch packages cannot rely on libdir, which is an arch-dependent variable. Rely on apxs -q libdir to extract the correct information instead.
* Tue Nov 05 2024 Martin Schreiner - Update httpd-framework to svn1921782.- Fixes Apache\'s impact on bsc#1218342.
* Mon Nov 04 2024 Jan Engelhardt - Explicitly mark start_apache2 as bash-dependent.
* Mon Sep 30 2024 Thorsten Kukuk - Add /srv/www directories to filelist [bsc#1231027] (apache2 will not start since default config uses this directory)
* Sat Aug 03 2024 Arjen de Korte - Update to 2.4.62
* ) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (cve.mitre.org) [boo#1228098] SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. Credits: Smi1e (DBAPPSecurity Ltd.)
* ) SECURITY: CVE-2024-40725: Apache HTTP Server: source code disclosure with handlers configured via AddType (cve.mitre.org) [boo#1228097] A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. \"AddType\" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue.
* ) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for \"balancer:\" URLs set via SetHandler, also allowing for \"unix:\" sockets with BalancerMember(s). PR 69168. [Yann Ylavic]
* ) mod_proxy: Avoid AH01059 parsing error for SetHandler \"unix:\" URLs. PR 69160 [Yann Ylavic]
* ) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2. [Joe Orton]
* ) mod_ssl: Add support for loading certs/keys from pkcs11: URIs via OpenSSL 3.x providers. [Ingo Franzki ]
* ) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0. [Ruediger Pluem, Yann Ylavic]
* ) mpm_worker: Fix possible warning (AH00045) about children processes not terminating timely. [Yann Ylavic]
* Thu Jul 04 2024 Arjen de Korte - Update to 2.4.61
* ) SECURITY: CVE-2024-39884: Apache HTTP Server: source code disclosure with handlers configured via AddType (cve.mitre.org) [boo#1227353] A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. \"AddType\" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.- Update to 2.4.60
* ) SECURITY: CVE-2024-39573: Apache HTTP Server: mod_rewrite proxy handler substitution (cve.mitre.org) [boo#1227271] Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL\'s to be handled by mod_proxy. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-38477: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (cve.mitre.org) [boo#1227270] null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-38476: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (cve.mitre.org) [boo#1227269] Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Note: Some legacy uses of the \'AddType\' directive to connect a request to a handler must be ported to \'AddHandler\' after this fix. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-38475: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (cve.mitre.org) [boo#1227268] Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-38474: Apache HTTP Server weakness with encoded question marks in backreferences (cve.mitre.org) [boo#1227278] Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Note: Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeAllow3F\" is specified. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-38473: Apache HTTP Server proxy encoding problem (cve.mitre.org) [boo#1227276] Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-38472: Apache HTTP Server on WIndows UNC SSRF (cve.mitre.org) [boo#1227267] SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Note: Existing configurations that access UNC paths will have to configure new directive \"UNCList\" to allow access during request processing. Credits: Orange Tsai (AATTorange_8361) from DEVCORE
* ) SECURITY: CVE-2024-36387: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (cve.mitre.org) [boo#1227272] Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. Credits: Marc Stern ()
* ) mod_proxy: Fix DNS requests and connections closed before the configured addressTTL. BZ 69126. [Yann Ylavic]
* ) core: On Linux, log the real thread ID in error logs. [Joe Orton]
* ) core: Support zone/scope in IPv6 link-local addresses in Listen and VirtualHost directives (requires APR 1.7.x or later). PR 59396 [Joe Orton]
* ) mod_ssl: Reject client-initiated renegotiation with a TLS alert (rather than connection closure). [Joe Orton, Yann Ylavic]
* ) Updated mime.types. [Mohamed Akram , Adam Silverstein ]
* ) mod_ssl: Fix a regression that causes the default DH parameters for a key no longer set and thus effectively disabling DH ciphers when no explicit DH parameters are set. PR 68863 [Ruediger Pluem]
* ) mod_cgid: Optional support for file descriptor passing, fixing error log handling (configure --enable-cgid-fdpassing) on Unix platforms. PR 54221. [Joe Orton]
* ) mod_cgid/mod_cgi: Distinguish script stderr output clearly in error logs. PR 61980. [Hank Ibell ]
* ) mod_tls: update version of rustls-ffi to v0.13.0. [Daniel McCarney (AATTcpu}]
* ) mod_md: - Using OCSP stapling information to trigger certificate renewals. Proposed by AATTfrasertweedale. - Added directive `MDCheckInterval` to control how often the server checks for detected revocations. Added proposals for configurations in the README.md chapter \"Revocations\". - OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is allowed in RFC 6960. Treat those as having an update interval of 12 hours. Added by AATTfrasertweedale. - Adapt OpenSSL usage to changes in their API. By Yann Ylavic.- removed patches (upstreamed) - apache2-issue-444.patch
* Sat Jun 15 2024 Georg Pfuetzenreuter - Require main apache2 package in MPM packages (boo#1226379)
* Thu Jun 13 2024 pgajdosAATTsuse.com- added patches [bsc#1226217] https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182 + apache2-issue-444.patch
* Thu Apr 04 2024 Arjen de Korte - Update to 2.4.59:
* ) mod_deflate: Fixes and better logging for handling various error and edge cases. [Eric Covener, Yann Ylavic, Joe Orton, Eric Norris ]
* ) Add CGIScriptTimeout to mod_cgi. [Eric Covener]
* ) mod_xml2enc: Tolerate libxml2 2.12.0 and later. PR 68610 [ttachi ]
* ) mod_slotmem_shm: Use ap_os_is_path_absolute() to make it portable. [Jean-Frederic Clere]
* ) mod_ssl: Use OpenSSL-standard functions to assemble CA name lists for SSLCACertificatePath/SSLCADNRequestPath. Names will now be consistently sorted. PR 61574. [Joe Orton]
* ) mod_xml2enc: Update check to accept any text/ media type or any XML media type per RFC 7303, avoiding corruption of Microsoft OOXML formats. PR 64339. [Joseph Heenan , Joe Orton]
* ) mod_http2: v2.0.26 with the following fixes: - Fixed `Date` header on requests upgraded from HTTP/1.1 (h2c). Fixes . - Fixed small memory leak in h2 header bucket free. Thanks to Michael Kaufmann for finding this and providing the fix.
* ) htcacheclean: In -a/-A mode, list all files per subdirectory rather than only one. PR 65091. [Artem Egorenkov ]
* ) mod_ssl: SSLProxyMachineCertificateFile/Path may reference files which include CA certificates; those CA certs are treated as if configured with SSLProxyMachineCertificateChainFile. [Joe Orton]
* ) htpasswd, htdbm, dbmmanage: Update help&docs to refer to \"hashing\", rather than \"encrypting\" passwords. [Michele Preziuso ]
* ) mod_ssl: Fix build with LibreSSL 2.0.7+. PR 64047. [Giovanni Bechis, Yann Ylavic]
* ) htpasswd: Add support for passwords using SHA-2. [Joe Orton, Yann Ylavic]
* ) core: Allow mod_env to override system environment vars. [Joe Orton]
* ) Allow mod_dav_fs to tolerate race conditions between PROPFIND and an operation which removes a directory/file between apr_dir_read() and apr_stat(). Current behaviour is to abort the connection which seems inferior to tolerating (and logging) the error. [Joe Orton]
* ) mod_ldap: HTML-escape data in the ldap-status handler. [Eric Covener, Chamal De Silva]
* ) mod_ssl: Disable the OpenSSL ENGINE API when OPENSSL_NO_ENGINE is set. Allow for \"SSLCryptoDevice builtin\" if the ENGINE API is not available, notably with OpenSSL >= 3. PR 68080. [Yann Ylavic, Joe Orton]
* ) mod_ssl: Improve compatibility with OpenSSL 3, fix build warnings about deprecated ENGINE_ API, honor OPENSSL_API_COMPAT setting while defaulting to compatibitily with version 1.1.1 (including ENGINEs / SSLCryptoDevice). [Yann Ylavic]
* ) mod_ssl: release memory to the OS when needed. [Giovanni Bechis]
* ) mod_proxy: Ignore (and warn about) enablereuse=on for ProxyPassMatch when some dollar substitution (backreference) happens in the hostname or port part of the URL. [Yann Ylavic]
* ) mod_proxy: Allow to set a TTL for how long DNS resolutions to backend systems are cached. [Yann Ylavic]
* ) mod_proxy: Add optional third argument for ProxyRemote, which configures Basic authentication credentials to pass to the remote proxy. PR 37355. [Joe Orton]
* Tue Feb 20 2024 Dominique Leuenberger - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN.
* Mon Jan 29 2024 Dirk Müller - use grep -E for egrep
* Thu Oct 19 2023 David Anes - Update to 2.4.58:
* ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST (cve.mitre.org) When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request\'s memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During \"normal\" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Credits: Will Dormann of Vul Labs
* ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 (cve.mitre.org) An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Credits: Prof. Sven Dietrich (City University of New York)
* ) SECURITY: CVE-2023-31122: mod_macro buffer over-read (cve.mitre.org) Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. Credits: David Shoon (github/davidshoon)
* ) mod_ssl: Silence info log message \"SSL Library Error: error:0A000126: SSL routines::unexpected eof while reading\" when using OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if available. [Rainer Jung]
* ) mod_http2: improved early cleanup of streams. [Stefan Eissing]
* ) mod_proxy_http2: improved error handling on connection errors while response is already underway. [Stefan Eissing]
* ) mod_http2: fixed a bug that could lead to a crash in main connection output handling. This occured only when the last request on a HTTP/2 connection had been processed and the session decided to shut down. This could lead to an attempt to send a final GOAWAY while the previous write was still in progress. See PR 66646. [Stefan Eissing]
* ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value. Fixes PR66752. [Stefan Eissing]
* ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as described in RFC 8441. A new directive \'H2WebSockets on|off\' has been added. The feature is by default not enabled. As also discussed in the manual, this feature should work for setups using \"ProxyPass backend-url upgrade=websocket\" without further changes. Special server modules for WebSockets will have to be adapted, most likely, as the handling if IO events is different with HTTP/2. HTTP/2 WebSockets are supported on platforms with native pipes. This excludes Windows. [Stefan Eissing]
* ) mod_rewrite: Fix a regression with both a trailing ? and [QSA]. in OCSP stapling. PR 66672. [Frank Meier , covener]
* ) mod_http2: fixed a bug in flushing pending data on an already closed connection that could lead to a busy loop, preventing the HTTP/2 session to close down successfully. Fixed PR 66624. [Stefan Eissing]
* ) mod_http2: v2.0.15 with the following fixes and improvements - New directive \'H2EarlyHint name value\' to add headers to a response, picked up already when a \"103 Early Hints\" response is sent. \'name\' and \'value\' must comply to the HTTP field restrictions. This directive can be repeated several times and header fields of the same names add. Sending a \'Link\' header with \'preload\' relation will also cause a HTTP/2 PUSH if enabled and supported by the client. - Fixed an issue where requests were not logged and accounted in a timely fashion when the connection returns to \"keepalive\" handling, e.g. when the request served was the last outstanding one. This led to late appearance in access logs with wrong duration times reported. - Accurately report the bytes sent for a request in the \'%O\' Log format. This addresses #203, a long outstanding issue where mod_h2 has reported numbers over-eagerly from internal buffering and not what has actually been placed on the connection. The numbers are now the same with and without H2CopyFiles enabled. [Stefan Eissing]
* ) mod_proxy_http2: fix retry handling to not leak temporary errors. On detecting that that an existing connection was shutdown by the other side, a 503 response leaked even though the request was retried on a fresh connection. [Stefan Eissing]
* ) mod_rewrite: Add server directory to include path as mod_rewrite requires test_char.h. PR 66571 [Valeria Petrov ]
* ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling of HTTP/2 requests in a forward proxy configuration. General forward proxying is enabled via `ProxyRequests`. If the HTTP/2 protocol is also enabled for such a server/host, this new directive is needed in addition. [Stefan Eissing]
* ) core: Updated conf/mime.types: - .js moved from \'application/javascript\' to \'text/javascript\' - .mjs was added as \'text/javascript\' - add .opus (\'audio/ogg\') - add \'application/vnd.geogebra.slides\' - add WebAssembly MIME types and extension [Mathias Bynens via PR 318, Richard de Boer , Dave Hodder , Zbynek Konecny ]
* ) mod_proxy_http2: fixed using the wrong \"bucket_alloc\" from the backend connection when sending data on the frontend one. This caused crashes or infinite loops in rare situations.
* ) mod_proxy_http2: fixed a bug in retry/response handling that could lead to wrong status codes or HTTP messages send at the end of response bodies exceeding the announced content-length.
* ) mod_proxy_http2: fix retry handling to not leak temporary errors. On detecting that that an existing connection was shutdown by the other side, a 503 response leaked even though the request was retried on a fresh connection.
* ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in the wrong order when a bucket_beam was destroyed. [Stefan Eissing]
* ) mod_http2: avoid double chunked-encoding on internal redirects. PR 66597 [Yann Ylavic, Stefan Eissing]
* ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count HTTP/2 requests twice. Fixes PR 66801. [Stefan Eissing]
* ) mod_ssl: Fix handling of Certificate Revoked messages in OCSP stapling. PR 66626. []
* ) mod_http2: fixed a bug in handling of stream timeouts. [Stefan Eissing]
* ) mod_tls: updating to rustls-ffi version 0.9.2 or higher. Checking in configure for proper version installed. Code fixes for changed clienthello member name. [Stefan Eissing]
* ) mod_md: - New directive `MDMatchNames all|servernames` to allow more control over how MDomains are matched to VirtualHosts. - New directive `MDChallengeDns01Version`. Setting this to `2` will provide the command also with the challenge value on `teardown` invocation. In version 1, the default, only the `setup` invocation gets this parameter. Refs #312. Thanks to AATTdomrim for the idea. - For Managed Domain in \"manual\" mode, the checks if all used ServerName and ServerAlias are part of the MDomain now reports a warning instead of an error (AH10040) when not all names are present. - MDChallengeDns01 can now be configured for individual domains. Using PR from Jérôme Billiras (AATTbilhackmac) and adding test case and fixing proper working - Fixed a bug found by Jérôme Billiras (AATTbilhackmac) that caused the challenge teardown not being invoked as it should.
* ) mod_ldap: Avoid performance overhead of APR-util rebind cache for OpenLDAP 2.2+. PR 64414. [Joe Orton]
* ) mod_http2: new directive \'H2MaxDataFrameLen n\' to limit the maximum amount of response body bytes put into a single HTTP/2 DATA frame. Setting this to 0 places no limit (but the max size allowed by the protocol is observed). The module, by default, tries to use the maximum size possible, which is somewhat around 16KB. This sets the maximum. When less response data is available, smaller frames will be sent.
* ) mod_md: fixed passing of the server environment variables to programs started via MDMessageCmd and MDChallengeDns01 on
*nix system. See . [Stefan Eissing]
* ) mod_dav: Add DavBasePath directive to configure the repository root path. PR 35077. [Joe Orton]
* ) mod_alias: Add AliasPreservePath directive to map the full path after the alias in a location. [Graham Leggett]
* ) mod_alias: Add RedirectRelative to allow relative redirect targets to be issued as-is. [Eric Covener, Graham Leggett]
* ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make sure that if the format is configured early enough it applies to every log line. PR 62161. [Yann Ylavic]
* ) mod_deflate: Add DeflateAlterETag to control how the ETag is modified. The \'NoChange\' parameter mimics 2.2.x behavior. PR 45023, PR 39727. [Eric Covener]
* ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
* ) mod_status: Remove duplicate keys \"BusyWorkers\" and \"IdleWorkers\". Resolve inconsistency between the previous two occurrences by counting workers in state SERVER_GRACEFUL no longer as busy, but instead in a new counter \"GracefulWorkers\" (or on HTML view as \"workers gracefully restarting\"). Also add the graceful counter as a new column to the existing HTML per process table for async MPMs. PR 63300. [Rainer Jung]
* Sat Aug 05 2023 Dirk Stoecker - Enable building of mod_md
* Fri Apr 07 2023 Arjen de Korte - Update to 2.4.57:
* ) mod_proxy: Check before forwarding that a nocanon path has not been rewritten with spaces during processing. [Yann Ylavic]
* ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not double encode encoded slashes in the URL sent by the reverse proxy to the backend. [Ruediger Pluem]
* ) mod_http2: fixed a crash during connection termination. See PR 66539. [Stefan Eissing]
* ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending in a question mark. PR66547. [Eric Covener]
* ) mod_rewrite: Add \"BCTLS\" and \"BNE\" RewriteRule flags. Re-allow encoded characters on redirections without the \"NE\" flag. [Yann Ylavic, Eric Covener]
* ) mod_proxy: Fix double encoding of the uri-path of the request forwarded to the origin server, when using mapping=encoded|servlet. [Yann Ylavic]
* ) mod_mime: Do not match the extention against possible query string parameters in case ProxyPass was used with the nocanon option. [Ruediger Pluem]
* Wed Mar 08 2023 David Anes - This update fixes the following security issues:
* CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
* CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy- Update to 2.4.56:
* ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be truncated without the initial logfile being truncated. [Eric Covener]
* ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to allow connections of any age to be reused. Up to now, a negative value was handled as an error when parsing the configuration file. PR 66421. [nailyk , Christophe Jaillet]
* ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number of headers. [Ruediger Pluem]
* ) mod_md: - Enabling ED25519 support and certificate transparency information when building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis. - MDChallengeDns01 can now be configured for individual domains. Thanks to Jérôme Billiras (AATTbilhackmac) for the initial PR. - Fixed a bug found by Jérôme Billiras (AATTbilhackmac) that caused the challenge teardown not being invoked as it should. [Stefan Eissing]
* ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors reported in access logs and error documents. The processing of the reset was correct, only unneccesary reporting was caused. [Stefan Eissing]
* ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation. [Yann Ylavic]
* Wed Jan 18 2023 David Anes - This update fixes the following security issues:
* CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
* CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
* CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte- Update to 2.4.55:
* ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (cve.mitre.org) Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Credits: Dimas Fariski Setyawan Putra (AATTnyxsorcerer)
* ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling (cve.mitre.org) Inconsistent Interpretation of HTTP Requests (\'HTTP Request Smuggling\') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. Credits: ZeddYu_Lu from Qi\'anxin Research Institute of Legendsec at Qi\'anxin Group
* ) SECURITY: CVE-2006-20001: mod_dav out of bounds read, or write of zero byte (cve.mitre.org) A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.
* ) mod_dav: Open the lock database read-only when possible. PR 36636 [Wilson Felipe , manu]
* ) mod_proxy_http2: apply the standard httpd content type handling to responses from the backend, as other proxy modules do. Fixes PR 66391. Thanks to Jérôme Billiras for providing the patch. [Stefan Eissing]
* ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981 [Basant Kumar Kukreja , Alejandro Alvarez ]
* ) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic]
* ) mod_http2: version 2.0.10 of the module, synchronizing changes with the gitgub version. This is a partial rewrite of how connections and streams are handled. - an APR pollset and pipes (where supported) are used to monitor the main connection and react to IO for request/response handling. This replaces the stuttered timed waits of earlier versions. - H2SerializeHeaders directive still exists, but has no longer an effect. - Clients that seemingly misbehave still get less resources allocated, but ongoing requests are no longer disrupted. - Fixed an issue since 1.15.24 that \"Server\" headers in proxied requests were overwritten instead of preserved. [PR by AATTdaum3ns] - A regression in v1.15.24 was fixed that could lead to httpd child processes not being terminated on a graceful reload or when reaching MaxConnectionsPerChild. When unprocessed h2 requests were queued at the time, these could stall. See #212. - Improved information displayed in \'server-status\' for H2 connections when Extended Status is enabled. Now one can see the last request that IO operations happened on and transferred IO stats are updated as well. - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection send a GOAWAY frame much too early on new connections, leading to invalid protocol state and a client failing the request. See PR65731 at . The module now initializes the HTTP/2 protocol correctly and allows the client to submit one request before the shutdown via a GOAWAY frame is being announced. - :scheme pseudo-header values, not matching the connection scheme, are forwarded via absolute uris to the http protocol processing to preserve semantics of the request. Checks on combinations of pseudo-headers values/absence have been added as described in RFC 7540. Fixes #230. - A bug that prevented trailers (e.g. HEADER frame at the end) to be generated in certain cases was fixed. See #233 where it prevented gRPC responses to be properly generated. - Request and response header values are automatically stripped of leading and trialing space/tab characters. This is equivalent behaviour to what Apache httpd\'s http/1.1 parser does. The checks for this in nghttp2 v1.50.0+ are disabled. - Extensive testing in production done by Alessandro Bianchi (AATTalexskynet) on the v2.0.x versions for stability. Many thanks!
* ) mod_proxy_http2: fixed #235 by no longer forwarding \'Host:\' header when request \':authority\' is known. Improved test case that did not catch that the previous \'fix\' was incorrect.
* ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
* ) mod_proxy: The AH03408 warning for a forcibly closed backend connection is now logged at INFO level. [Yann Ylavic]
* ) mod_ssl: When dumping the configuration, the existence of certificate/key files is no longer tested. [Joe Orton]
* ) mod_authn_core: Add expression support to AuthName and AuthType. [Graham Leggett]
* ) mod_ssl: when a proxy connection had handled a request using SSL, an error was logged when \"SSLProxyEngine\" was only configured in the location/proxy section and not the overall server. The connection continued to work, the error log was in error. Fixed PR66190. [Stefan Eissing]
* ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302. [Alessandro Cavaliere ]
* ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300. [Alessandro Cavaliere ]
* ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
* ) mod_md: a new directive `MDStoreLocks` can be used on cluster setups with a shared file system for `MDStoreDir` to order activation of renewed certificates when several cluster nodes are restarted at the same time. Store locks are not enabled by default. Restored curl_easy cleanup behaviour from v2.4.14 and refactored the use of curl_multi for OCSP requests to work with that. Fixes .
* ) core: Avoid an overflow on large inputs in ap_is_matchexp. PR 66033 [Ruediger Pluem]
* ) mod_heartmonitor: Allow \"HeartbeatMaxServers 0\" to use file based storage instead of slotmem. Needed after setting HeartbeatMaxServers default to the documented value 10 in 2.4.54. PR 66131. [Jérôme Billiras]
* ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery This is a game changer for performances if client use PROPFIND a lot, PR 66313. [Emmanuel Dreyfus]