                                                         -*- coding: utf-8 -*-
Changes with Apache 2.4.70

  *) mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows.
     PR 70261. [Eric Covener]

  *) mod_cgid: Increase limits for number and length of 
     environment variables, URI and arguments.  PR 70270.
     [Emmanuel Dreyfus <manu netbsd.org>, Joe Orton]

  *) mod_substitute: Fix an integer overflow that can happen in very special
     setups.  PR 66034 [Ruediger Pluem]

  *) mod_cache: Do not store a response whose "Vary: *" was set via
     "Header always".  PR 70289 [Arturo Bernal]

  *) mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which
     under-reserved space for the stored key length field, written as
     apr_size_t but sized as int.  PR 70298 [Arturo Bernal]

Changes with Apache 2.4.69

  *) SECURITY: CVE-2026-93546: mod_dav_fs namespace overflow
     (cve.mitre.org)
     Integer overflow in mod_dav_fs in Apache HTTP Server through
     2.4.68 allows an authenticated WebDAV client with write access
     to crash worker processes and persistently corrupt a directory's
     property database via PROPPATCH requests declaring many XML
     namespaces.
     Credits: Zhen Kong

  *) SECURITY: CVE-2026-79768: mod_userdir information disclosure
     (cve.mitre.org)
     Path equivalence: '/./' (single dot directory) vulnerability in
     Apache HTTP Server's mod_userdir module when configured
     with absolute non-wildcard UserDir directive (the 2nd form
     in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Vlatko Kosturjak, Marlink Cyber

  *) SECURITY: CVE-2026-73637: mod_auth_digest DoS attack
     (cve.mitre.org)
     Use after free in mod_auth_digest in Apache Software Foundation
     Apache HTTP Server before 2.4.69 on all platforms allows an
     unauthenticated remote client to cause authentication state
     corruption via concurrent Digest authentication requests when
     AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set
     to 0.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Zhen Kong

  *) SECURITY: CVE-2026-73636: mod_auth_digest one-time-nonce replay
     attack (cve.mitre.org)
     Authentication bypass by capture-replay in mod_auth_digest in
     Apache Software Foundation Apache HTTP Server 2.4.x on all
     platforms allows a man-in-the-middle (MITM) attacker to replay
     captured digest authentication credentials via crafted requests
     that trigger garbage collection of the client's shared memory
     entry when AuthDigestNonceLifetime is set to 0.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Hyojae Lee

  *) SECURITY: CVE-2026-63718: mod_proxy_uwsgi Transfer-Encoding
     response smuggling (cve.mitre.org)
     Inconsistent Interpretation of HTTP Requests ('HTTP
     Request/Response Smuggling') response smuggling vulnerability in
     Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi
     response with Transfer-Encoding.
     This issue affects Apache HTTP Server: from 2.4.30 through
     2.4.68.
     Credits: Qing Xu

  *) SECURITY: CVE-2026-63686: mod_xml2enc crash on charset
     conversion failure (cve.mitre.org)
     A NULL pointer dereference in mod_xml2enc in Apache Software
     Foundation Apache HTTP Server before 2.4.69 on all platforms
     allows an untrusted backend server to cause a denial of service
     via a proxied response with a charset whose conversion partially
     succeeds then fails.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-63292: mod_vhost_alias stack overflow
     (cve.mitre.org)
     Stack-based buffer overflow in mod_vhost_alias in Apache
     Software Foundation Apache HTTP Server through 2.4.68 on all
     platforms allows a remote client to cause a denial of service or
     potentially execute arbitrary code via an HTTP request with a
     Host header exceeding 8192 bytes when VirtualDocumentRoot uses a
     hostname format specifier and LimitRequestFieldSize is raised
     above the default.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Hyojae Lee

  *) SECURITY: CVE-2026-63045: mod_proxy_ftp PASV address handling
     (cve.mitre.org)
     Improper validation of FTP PASV reply address in mod_proxy_ftp
     in Apache Software Foundation Apache HTTP Server through 2.4.68
     on all platforms allows, in forward proxy configurations, an
     untrusted FTP server to cause the proxy to open a data
     connection to an arbitrary third-party host via a crafted PASV
     response.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Zhen Kong

  *) SECURITY: CVE-2026-59797: mod_ssl SSLRequire allows .htaccess
     ap_expr file-function (cve.mitre.org)
     Improper Privilege Management vulnerability in Apache HTTP
     Server's mod_ssl via SSLRequire and file-related expressions.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: kimchunbok

  *) SECURITY: CVE-2026-59685: Out-of-Bounds Write in
     ap_directory_walk() Canonical-Name Rewrite on
     CASE_BLIND_FILESYSTEM (cve.mitre.org)
     Out-of-bounds Write vulnerability in Apache HTTP Server on
     Windows while processing paths with 8.3 names that may grow when
     expanded.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Dhiraj Mishra

  *) SECURITY: CVE-2026-58415: mod_dav_fs property database read
     access (cve.mitre.org)
     Internal state files accessible to external parties in
     mod_dav_fs in Apache Software Foundation Apache HTTP Server
     before 2.4.69 on all platforms allows a remote client to read
     WebDAV dead properties of resources it cannot author via a GET
     request for the .DAV state directory
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: 이지웅 (kimchunbok)

  *) SECURITY: CVE-2026-57941: mod_http2 use-after-free / wild write
     via shared session->bbtmp re-entrancy (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server's
     mod_http2 via shared session->bbtmp re-entrancy
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-56449: mod_proxy_html: crash in dump_content
     (cve.mitre.org)
     Out-of-bounds Write vulnerability in Apache HTTP Server's
     mod_proxy_html with crafted HTTP response bodies.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-56154: mod_rewrite use-after-free via
     %{LA-U:HTTP:...} (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server's mod_rewrite
     when using lookahead (%{LA-U:HTTP:...})
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Nebula Security (@nebusecurity)

  *) SECURITY: CVE-2026-56153: mod_charset_lite: Heap overflow in
     finish_partial_char (cve.mitre.org)
     Out-of-bounds Write vulnerability in Apache HTTP Server's
     mod_charset_lite.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Bartlomiej Dmitruk at striga.ai

  *) SECURITY: CVE-2026-48005: mod_auth_digest reauthentication
     attack (cve.mitre.org)
     Missing authentication checks in mod_auth_digest in Apache
     Software Foundation Apache HTTP Server before 2.4.69 on all
     platforms allows an unauthenticated remote client to cause a
     denial of service (forced re-authentication) via forged
     Authorization headers when Digest authentication is enabled with
     AuthDigestNcCheck .
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: lokerxx

  *) SECURITY: CVE-2026-47360: mod_session: Session cookie not
     removed during internal redirect (cve.mitre.org)
     Exposure of Sensitive Information to an Unauthorized Actor
     vulnerability in Apache HTTP Server's mod_session_cookie module.

     When SessionCookieRemove changes across internal redirects, the
     session cookie may still be passed to a backend server.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: lokerxx

  *) SECURITY: CVE-2026-46729: mod_heartmonitor denial of service
     (cve.mitre.org)
     NULL Pointer Dereference vulnerability in Apache HTTP Servers
     mod_heartmonitor over unicast listener.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Zhang San

  *) SECURITY: CVE-2026-42528: mod_dav shared lock overflow
     (cve.mitre.org)
     A memory calculation bug in mod_dav in Apache httpd 2.4.67 and
     earlier allows an attacker with permission to create WebDAV
     locks to crash server child processes.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42356: limited RCE for some internal
     redirects to non-CGI files in CGI directories (cve.mitre.org)
     Deployment of wrong handler vulnerability in Apache HTTP Server
     allows the target of some internal redirects from CGI programs
     to also be treated as CGI and executed. The target must already
     be in a directory enabled for CGI and have no other extension
     understood by mod_mime.
     This issue affects Apache HTTP Server: from 2.4.60 through
     2.4.68.
     Credits: Feliks Penconek

  *) Fix the tar icon in the documentation so that its background is
     transparent.  PR 70238.  [Jeffery To <jeffery.to gmail.com>]

  *) mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore,
     X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1.
     PR 70205.  [Craig Lorentzen <crlorent amazon.com>]

  *) mod_cgid, mod_ssl, mod_md: Various hardening fixes.  [Various authors]

  *) mod_md: MDServerStatus is now disabled by default.  [Joe Orton]

  *) mod_auth_digest: Fix compatibility with expression-based AuthName.
     PR 59039.  [Eric Covener]

  *) mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory
     handling and client nonce handling; "authdigest-opaque" mutex is
     now longer needed.  [Joe Orton]

  *) mod_lbmethod_heartbeat: Use safe integer parsing with range
     validation, replacing atoi().  [Sayed Kaif <metsw24 gmail.com>]

  *) core: Reject control characters in the reason phrase of interim
     responses.  Only accept space as status-code separator.  [Joe Orton]

  *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
     large for the K/M/G suffix.  [Joe Orton]

  *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
     directive with a missing closing delimiter.  [Joe Orton]

  *) mod_dir: Fix a crash in fixup_dir for a request not mapped to any type. 
     PR68527.  [Eric Covener]

  *) mod_http2: Do not drop an in-flight response when a client sends a
     graceful GOAWAY (error code 0) while streams it opened are still
     being processed. The session now drains open streams instead of
     tearing down immediately, which async MPMs hit far more than event.
     Fixes a silently dropped response; RFC 9113 compliant. [Jim Jagielski]

  *) mod_md: OpenSSL 4 compatibility.

  *) pytest_suite: Port of the old PERL test framework to Python
     and pytest. Now included in the source tree under ./test
     [Jim Jagielski]

Changes with Apache 2.4.68

  *) SECURITY: CVE-2026-49975: mod_http2 denial of service
     (cve.mitre.org)
     Memory Allocation with Excessive Size Value vulnerability in
     Apache HTTP Server's mod_http leads to denial of service via
     malicious HTTP requests.
     This issue affects Apache HTTP Server: from 2.4.17 through
     2.4.67.
     Credits: Quang Luong of Calif.IO in collaboration with OpenAI
     Codex

  *) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
     handles exhausted (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server module
     mod_http2 when file handles are already exhausted.
     This issue affects Apache HTTP Server: from 2.4.55 through
     2.4.67.
     Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)

  *) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
     Signed Char Overflow (cve.mitre.org)
     Buffer Underwrite vulnerability in Apache HTTP Server on crafted
     regular expressions in the configuration.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
     mod_proxy_ftp (cve.mitre.org)
     Loop with Unreachable Exit Condition ('Infinite Loop')
     vulnerability in the mod_proxy_ftp module in Apache HTTP Server
     with an attacker controlled backend FTP server.
     This issue affects undefined: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
     `send_request` (cve.mitre.org)
     Buffer Over-read vulnerability in Apache HTTP Server via
     outbound OCSP requests to an attacker controlled OCSP server
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44119: escalation of privilege through
     expressions in .htaccess in multiple modules (cve.mitre.org)
     Improper Privilege Management vulnerability in Apache HTTP
     Server 2.4.67 and earlier allows local .htaccess authors to read
     files with the privileges of the httpd user.
     This issue affects Apache HTTP Server: from through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
     can cause crash (cve.mitre.org)
     Out-of-bounds Read vulnerability in Apache HTTP Server with
     mod_headers and mod_mime and multiple response languages.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
     (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache HTTP Server
     with mod_xml2enc, xml2StartParse, and untrusted content
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
     (cve.mitre.org)
     A path handling issue in mod_dav_fs in Apache 2.4.67 and
     earlier allows a WebDAV content author to directly manipulate
     trusted DAV property databases, potentially causing child
     process crashes.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
     overflow (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache HTTP Server
     with malicious backend servers and ProxyPassReverseCookie*
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Arkadi Vainbrand

  *) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
     (cve.mitre.org)
     A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
     and earlier allows an attack by an untrusted backend.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Elhanan Haenel

  *) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
     A cross-site scripting vulnerability exists in mod_proxy_ftp's
     HTML directory list generation in Apache HTTP Server 2.4.67 and
     earlier when listing FTP directory contents either via forward
     or reverse proxy configuration.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
     (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server with mod_ldap
     in per-directory configuration
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) mod_ssl, ab: Add support for OpenSSL 4.0.  [Joe Orton]

  *) mod_ssl: Add SerialNumber as a recognized attribute type for SSL
     distinguished name variables.  [Michael Osipov <michaelo apache.org>,
     Benjamin Demarteau <benjamin.demarteau liege.be>]

  *) mod_ssl: Set auth type to "ClientCert" when client certificate authentication
     has been performed.  [Michael Osipov <michaelo apache.org>]

  *) mod_include: Don't print any of if/elsif/else content when
     a conditional evaluation returns an error. [Eric Covener]

  *) mod_unixd: CoreDumpDirectory requires enabling tracing on FreeBSD 11+.
     PR 65819.  [David CARLIER <devnexen gmail.com>]

  *) mod_file_cache: Fix crashes for mmap'ed files under threaded
     MPMs. PR 69901. barr.israel <barr.israel campus.technion.ac.il>

  *) core: Add support for %{m}t in ErrorLogFormat to log milli-second
     time resolution (in addition to existing %{u}t for micro-seconds).
     [Luboš Uhliarik <luhliari redhat.com>]

  *) mod_unixd: Drop test that effective user ID is zero in
     a chroot configuration.  PR 69767.
     [Bastien Roucaries <rouca debian.org>]

  *) mod_proxy_balancer: Include nonce in XML output.  PR 63074.
     Federico Mennite <federico.mennite lifeware.ch>

  *) mod_http2: update to version 2.0.42
     Fix excessive file description use for non-TLS frontend connections when
     sending files. Fixes <https://github.com/icing/mod_h2/issues/325>
     [Stefan Eissing]

  *) mod_http2: update to version 2.0.41
     Fix cookie header accounting against LimitRequestFields.
     [Stefan Eissing]

  *) mod_http2: update to version 2.0.40
     Fix error handling on upload requests when server runs out of file
     handles that left beam bucket callbacks in place, potentially using
     no longer valid references. Only applies on platforms with pipes
     and file descriptor limits not healthy for a network server.
     [Stefan Eissing]

  *) mod_dav_fs: Return a 404 for DELETE if deletion fails because the
     resource no longer exists.  PR 60746.  [Joe Orton]

  *) mod_proxy_hcheck: Fix healthcheck disabled due to child restart while
     updating. [Yann Ylavic]

Changes with Apache 2.4.67

  *) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
     Heap Over-Read and memory disclosure in  ajp_parse_data()
     (cve.mitre.org)
     Buffer Over-read vulnerability in Apache HTTP Server.
     This issue affects Apache HTTP Server: through 2.4.66.
     Credits: Elhanan Haenel

  *) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
     Heap Buffer Over-Read Due to Missing Null-Termination Check
     (ajp_msg_get_string) (cve.mitre.org)
     Improper Null Termination, Out-of-bounds Read vulnerability in
     Apache HTTP Server.
     This issue affects Apache HTTP Server: through 2.4.66.
     Credits: Tianshuo Han (<hantianshuo233@gmail.com>)

  *) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
     reads in AJP getter functions (cve.mitre.org)
     Out-of-bounds Read vulnerability in mod_proxy_ajp of
     Apache HTTP Server.
     This issue affects Apache HTTP Server: through 2.4.66.
     Credits: Elhanan Haenel

  *) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
     HTTP response splitting forwarding malicious status line
     (cve.mitre.org)
     HTTP response splitting vulnerability in multiple Apache HTTP
     Server modules with untrusted or compromised backend servers.
     This issue affects Apache HTTP Server: from through 2.4.66.
     Credits: Haruki Oyama (Waseda University)

  *) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
     crash (cve.mitre.org)
     A NULL pointer dereference in the mod_authn_socache in Apache
     HTTP Server 2.4.66 and earlier allows an unauthenticated remote
     user to crash a child process in a caching forward proxy
     configuration.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
     timing attack (cve.mitre.org)
     A timing attack against mod_auth_digest in Apache HTTP Server
     2.4.66 allows a bypass of Digest authentication by a remote
     attacker.
     Credits: Nitescu Lucian

  *) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
     indirect lock crash (cve.mitre.org)
     A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
     2.4.66 and earlier may allow an attacker to crash the server
     with a malicious request.mod_dav_lock is not used internally by
     mod_dav or mod_dav_fs.
     The only known use-case for mod_dav_lock was mod_dav_svn from
     Apache Subversion earlier than version 1.2.0.
     Users are recommended to upgrade to version 2.4.67, which fixes
     this issue, or remove mod_dav_lock.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
     unrestricted OCSP response (cve.mitre.org)
     Allocation of Resources Without Limits or Throttling
     vulnerability in Apache HTTP Server's  mod_md via OCSP response
     data.
     This issue affects Apache HTTP Server: from 2.4.30 through
     2.4.66.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
     mod_proxy_ajp via  ajp_msg_check_header() (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
     Apache HTTP Server.
     If mod_proxy_ajp connects to a malicious AJP server this AJP
     server can send a malicious AJP message back to mod_proxy_ajp
     and cause it to write 4 attacker controlled bytes after the end
     of a heap based buffer.
     This issue affects Apache HTTP Server: through 2.4.66.
     Credits: Andrew Lacambra

  *) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
     elevation of privileges via ap_expr (cve.mitre.org)
     An escalation of privilege bug in various modules in Apache HTTP
     2.4.66 and earlier allows local .htaccess authors to read files
     with the privileges of the httpd user.
     Credits: y7syeu

  *) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
     and possible RCE on early reset (cve.mitre.org)
     Double Free and possible RCE vulnerability in Apache HTTP Server
     with the HTTP/2 protocol.
     This issue affects Apache HTTP Server: 2.4.66.
     Credits: Bartlomiej Dmitruk, striga.ai

  *) mod_md: update to version 2.6.10
     - Fix issue #420 <https://github.com/icing/mod_md/issues/420> by ignoring
       job.json files that claim to have completely finished a certificate
       renewal, but have not produced the necessary result files.

  *) mod_http2: update to version 2.0.39
     Remove streams own memory allocator after reports of memory problems
     with third party modules.
     [Stefan Eissing]

  *) mod_http2: update to version 2.0.38
     Source sync with mod_h2 github repository. No functional change.
     [Stefan Eissing]

  *) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
     [Alexandru Mărășteanu <hello alexei.ro>]

  *) mod_md: update to version 2.6.7
     - Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
       applied, no matter the configuration.

  *) mod_md: update to version 2.6.9
     - Pebble 2.9+ reports another error when terms of service agreement is
       not set. Treating all "userActionRequired" errors as permanent now.

  *) mod_md: update to version 2.6.8
     - Fix the ARI related `replaces` property in ACME order creation to only
       be used when the CA supports ARI and it is enabled in the menu config.
     - Fix compatibility with APR versions before 1.6.0 which do not have
       `apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.

  *) mod_http2: update to version 2.0.37
     Prevent double purge of a stream, resulting in a double free.
     Fixes PR 69899.
     [Stefan Eissing]

  *) mod_md: Use correct function name when compiling against APR < 1.6.0.
     PR 69954 [Tần Quảng <baobaoxich@gmail.com>]

Changes with Apache 2.4.66

  *) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec
     bypass via AllowOverride FileInfo (cve.mitre.org)
     mod_userdir+suexec bypass via AllowOverride FileInfo
     vulnerability in Apache HTTP Server. Users with access to use
     the RequestHeader directive in htaccess can cause some CGI
     scripts to run under an unexpected userid.
     Credits: Mattias Åsander (Umeå University)

  *) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment
     variable override (cve.mitre.org)
     Improper Neutralization of Escape, Meta, or Control Sequences
     vulnerability in Apache HTTP Server through environment
     variables set via the Apache configuration unexpectedly
     superseding variables calculated by the server for CGI programs.
     Credits: Mattias Åsander (Umeå University)

  *) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on
     Windows through UNC SSRF (cve.mitre.org)
     Server-Side Request Forgery (SSRF) vulnerability
     in Apache HTTP Server on Windows with AllowEncodedSlashes On and
     MergeSlashes Off allows to potentially leak NTLM hashes to a malicious 
     server via SSRF and malicious requests or content
     Credits: Orange Tsai (@orange_8361) from DEVCORE

  *) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side
     Includes adds query string to #exec cmd=... (cve.mitre.org)
     Apache HTTP Server 2.4.65 and earlier with Server Side Includes
     (SSI) enabled and mod_cgid (but not mod_cgi) passes the
     shell-escaped query string to #exec cmd="..." directives.
     Credits: Anthony Parfenov (United Rentals, Inc.)

  *) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME),
     unintended retry intervals (cve.mitre.org)
     An integer overflow in the case of failed ACME certificate
     renewal leads, after a number of failures (~30 days in default
     configurations), to the backoff timer becoming 0. Attempts to
     renew the certificate then are repeated without delays until it
     succeeds.
     Credits: Aisle Research

  *) mod_http2: Fix handling of 304 responses from mod_cache. PR 69580.
     [Stefan Eissing]

  *) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of
     integers, used in push diaries and proxy window size calculations.
     PR69741 [Benjamin P. Kallus]

  *) mod_md: update to version 2.6.5
     - New directive `MDInitialDelay`, controlling how longer to wait after
       a server restart before checking certificates for renewal.
       [Michael Kaufmann]
     - Hardening: when build with OpenSSL older than 1.0.2 or old libressl
       versions, the parsing of ASN.1 time strings did not do a length check.
     - Hardening: when reading back OCSP responses stored in the local JSON
       store, missing 'valid' key led to uninitialized values, resulting in
       wrong refresh behaviour.

  *) mod_md: update to version 2.6.6
     - Fix a small memory leak when using OpenSSL's BIGNUMs. [Theo Buehler]
     - Fix reuse of curl easy handles by resetting them. [Michael Kaufmann]

  *) mod_http2: update to version 2.0.35
     New directive `H2MaxStreamErrors` to control how much bad behaviour
     by clients is tolerated before the connection is closed.
     [Stefan Eissing]

  * mod_proxy_http2: add support for ProxyErrorOverride directive. PR69771

  *) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify
     the value set for the TCP_DEFER_ACCEPT socket option on listen sockets.
     [Ruediger Pluem]

  *) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual
     host compatibility policy.  PR 69743.  [Joe Orton]

  *) mod_md: update to version 2.6.2
     - Fix error retry delay calculation to not already doubling the wait
       on the first error.

  *) mod_md: update to version 2.6.1
     - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty
       traffic on errored renewals for the ACME CA. This leads to error retries
        of 30s, 1 minute, 2, 4, etc. up to daily attempts.
     - Checking that configuring `MDRetryDelay` will result in a positive
       duration. A delay of 0 is not accepted.
     - Fix a bug in checking Content-Type of responses from the ACME server.
     - Added ACME ARI support (rfc9773) to the module. Enabled by default. New
       directive "MDRenewViaARI on|off" for controlling this.
     - Removing tailscale support. It has not been working for a long time
       as the company decided to change their APIs. Away with the dead code,
       documentation and tests.
     - Fixed a compilation issue with pre-industrial versions of libcurl.

Changes with Apache 2.4.65

  *) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr'
     always evaluates to true in 2.4.64 (cve.mitre.org)
     A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond
     expr ..." tests evaluating as "true".
     Users are recommended to upgrade to version 2.4.65, which fixes
     the issue.

Changes with Apache 2.4.64

  *) SECURITY: CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by
     Memory Increase (cve.mitre.org)
     Late Release of Memory after Effective Lifetime vulnerability in
     Apache HTTP Server.
     This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63.
     Users are recommended to upgrade to version 2.4.64, which fixes
     the issue.
     Credits: Gal Bar Nahum

  *) SECURITY: CVE-2025-49812: Apache HTTP Server: mod_ssl TLS
     upgrade attack (cve.mitre.org)
     In some mod_ssl configurations on Apache HTTP Server versions
     through to 2.4.63, an HTTP desynchronisation attack allows a
     man-in-the-middle attacker to hijack an HTTP session via a TLS
     upgrade.
     Only configurations using "SSLEngine optional" to enable TLS
     upgrades are affected. Users are recommended to upgrade to
     version 2.4.64, which removes support for TLS upgrade.
     Credits: Robert Merget (Technology Innovation Institute)

  *) SECURITY: CVE-2025-49630: Apache HTTP Server: mod_proxy_http2
     denial of service (cve.mitre.org)
     In certain proxy configurations, a denial of service attack
     against Apache HTTP Server versions 2.4.26 through to 2.4.63
     can be triggered by untrusted clients causing an assertion in
     mod_proxy_http2.
     Configurations affected are a reverse proxy is configured for an
     HTTP/2 backend, with ProxyPreserveHost set to "on".
     Credits: Anthony CORSIEZ

  *) SECURITY: CVE-2025-23048: Apache HTTP Server: mod_ssl access
     control bypass with session resumption (cve.mitre.org)
     In some mod_ssl configurations on Apache HTTP Server 2.4.35
     through to 2.4.62, an access control bypass by trusted clients
     is possible using TLS 1.3 session resumption.
     Configurations are affected when mod_ssl is configured for
     multiple virtual hosts, with each restricted to a different set
     of trusted client certificates (for example with a different
     SSLCACertificateFile/Path setting). In such a case, a client
     trusted to access one virtual host may be able to access another
     virtual host, if SSLStrictSNIVHostCheck is not enabled in either
     virtual host.
     Credits: Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy,
     and Juraj Somorovsky at Paderborn University

  *) SECURITY: CVE-2024-47252: Apache HTTP Server: mod_ssl error log
     variable escaping (cve.mitre.org)
     Insufficient escaping of user-supplied data in mod_ssl in Apache
     HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS
     client to insert escape characters into log files in some
     configurations.
     In a logging configuration where CustomLog is used with
     "%{varname}x" or "%{varname}c" to log variables provided by
     mod_ssl such as SSL_TLS_SNI, no escaping is performed by either
     mod_log_config or mod_ssl and unsanitized data provided by the
     client may appear in log files.
     Credits: John Runyon

  *) SECURITY: CVE-2024-43394: Apache HTTP Server: SSRF on Windows
     due to UNC paths (cve.mitre.org)
     Server-Side Request Forgery (SSRF) in Apache HTTP Server on
     Windows allows to potentially leak NTLM hashes to a malicious
     server via
     mod_rewrite or apache expressions that pass unvalidated request
     input.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.
     Note:  The Apache HTTP Server Project will be setting a higher
     bar for accepting vulnerability reports regarding SSRF via UNC
     paths.
     The server offers limited protection against administrators
     directing the server to open UNC paths.
     Windows servers should limit the hosts they will connect over
     via SMB based on the nature of NTLM authentication.
     Credits: Kainan Zhang (@4xpl0r3r) from Fortinet

  *) SECURITY: CVE-2024-43204: Apache HTTP Server: SSRF with
     mod_headers setting Content-Type header (cve.mitre.org)
     SSRF in Apache HTTP Server with mod_proxy loaded allows an
     attacker to send outbound proxy requests to a URL controlled by
     the attacker.  Requires an unlikely configuration where
     mod_headers is configured to modify the Content-Type request or
     response header with a value provided in the HTTP request.
     Users are recommended to upgrade to version 2.4.64 which fixes
     this issue.

  *) SECURITY: CVE-2024-42516: Apache HTTP Server: HTTP response
     splitting (cve.mitre.org)
     HTTP response splitting in the core of Apache HTTP Server allows
     an attacker who can manipulate the Content-Type response headers
     of applications hosted or proxied by the server can split the
     HTTP response.
     This vulnerability was described as CVE-2023-38709 but the patch
     included in Apache HTTP Server 2.4.59 did not address the issue.
     Users are recommended to upgrade to version 2.4.64, which fixes
     this issue.
     Credits: xiaojunjie@安恒信息杭州市滨江区技能大师工作室

  *) mod_proxy_ajp: Use iobuffersize set on worker level for the IO buffer
     size. PR 69402 [Jari Ahonen <jah@progress.com>]

  *) mod_ssl: Drop $SSLKEYLOGFILE handling internally for OpenSSL 3.5
     builds which enable it in libssl natively.  [Joe Orton]

  *) mod_asis: Fix the log level of the message AH01236.
     Github #527 [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_session_dbd: ensure format used with SessionDBDCookieName and
     SessionDBDCookieName2 are correct.
     Github #503 [Thomas Meyer <thomas m3y3r.de>]

  *) mod_headers: 'RequestHeader set|edit|edit_r Content-Type X' could
     inadvertently modify the Content-Type _response_ header. Applies to
     Content-Type only and likely to only affect static file responses.
     [Eric Covener]

  *) mod_ssl: Remove warning over potential uninitialised value
     for ssl protocol prior to protocol selection.
     [Graham Leggett]

  *) mod_proxy: Reuse ProxyRemote connections when possible, like prior
     to 2.4.59.  [Jean-Frederic Clere, Yann Ylavic]

  *) mod_systemd: Add systemd socket activation support.  [Paul Querna,
     Jan Kaluza, Lubos Uhliarik <luhliari redhat.com>, Joe Orton]

  *) mod_systemd: Log the SELinux context at startup if available and
     enabled.  [Joe Orton]

  *) mod_http2: update to version 2.0.32
     The code setting the connection window size was set wrong,
     preventing `H2WindowSize` to work.
     Fixed <https://github.com/icing/mod_h2/issues/300>.
     [Stefan Eissing, Michael Kaufmann]

  *) mod_http2: update to version 2.0.30
     - Fixed bug in handling over long response headers. When the 64 KB limit
       of nghttp2 was exceeded, the request was not reset and the client was
       left hanging, waiting for it. Now the stream is reset.
     - Added new directive `H2MaxHeaderBlockLen` to set the limit on response
       header sizes.
     - Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
       connection was reset.

  *) mod_lua: Fix memory handling in LuaOutputFilter. PR 69590.
     [Guillermo Grandes <guillermo.grandes gmail.com>]

  * mod_proxy_http2: revert r1912193 for detecting broken backend connections
    as this interferes with backend selection who a node is unresponsive.
    PR69624.

  *) mod_proxy_balancer: Fix a regression that caused stickysession keys no
     longer be recognized if they are provided as query parameter in the URL.
     PR 69443 [Ruediger Pluem]

  *) mod_md: update to version 2.5.2
     - Fixed TLS-ALPN-01 challenges when multiple `MDPrivateKeys` are specified
       with EC keys before RSA ones. Fixes #377. [Stefan Eissing]
     - Fixed missing newlines in the status page output. [Andreas Groth]

  *) mod_dav: Add API to expose DavBasePath setting.  [Joe Orton]

  *) mod_md: update to version 2.5.1
     - Added support for ACME profiles with new directives MDProfile and
       MDProfileMandatory.
     - When installing a custom CA file via `MDCACertificateFile`, also set the
       libcurl option CURLSSLOPT_NO_REVOKE that suppresses complains by Schannel
       (when curl is linked with it) about missing CRL/OCSP in certificates.
     - Fixed handling of corrupted httpd.json and added test 300_30 for it.
       File is removed on error and written again. Fixes #369.
     - Added explanation in log for how to proceed when md_store.json could not be
       parsed and prevented the server start.
     - restored fixed to #336 and #337 which got lost in a sync with Apache svn
     - Add Issue Name/Uris to certificate information in md-status handler
     - MDomains with static certificate files have MDRenewMode "manual", unless
       "always" is configured.

  *) core: Report invalid Options= argument when parsing AllowOverride
     directives.
     Github #310 [Zhou Qingyang <zhou1615 umn.edu>]

  *) scoreboard/mod_http2: record durations of HTTP/2 requests.
     PR 69579 [Pierre Brochard <pierre.brochard.1982@m4x.org>]

Changes with Apache 2.4.63

  *) mod_dav: Update redirect-carefully example BrowserMatch config
     to match more recent client versions.  PR 66148, 67039.
     [Michal Maloszewski <michal.maloszewski canonical.com>,
      Romain Tartière <romain blogreen.org>]

  *) mod_cache_socache: Fix possible crash on error path. PR 69358.
     [Ruediger Pluem]

  *) mod_ssl: Fail cleanly at startup if OpenSSL initialization fails.
     [StephenWall]

  *) mod_md: update to version 2.4.31
     - Improved error reporting when waiting for ACME server to verify domains
       or finalizing the order fails, e.g. times out.
     - Increasing the timeouts to wait for ACME server to verify domain names
       and issue the certificate from 30 seconds to 5 minutes.
     - Change a log level from error to debug when Stapling is enabled but a
       certificate carries no OCSP responder URL.

  *) mod_proxy_balancer: Fix the handling of the stickysession configuration
     parameter by the balancer manager. PR 69510
     [Yutaka Tokunou <tokunou.yutaka@fujitsu.com>]

  *) Add the ldap-search option to mod_authnz_ldap, allowing authorization
     to be based on arbitrary expressions that do not include the username.
     Make sure that when ldap searches are too long, we explicitly log the
     error. [Graham Leggett]

  *) mod_proxy: Honor parameters of ProxyPassMatch workers with substitution
     in the host name or port. PR 69233. [Yann Ylavic]

  *) mod_log_config: Fix merging for the "LogFormat" directive.
     PR 65222. [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_lua: Make r.ap_auth_type writable.  PR 62497.
     [Michael Osipov <michaelo apache.org>]

  *) mod_md: update to version 2.4.29
     - Fixed HTTP-01 challenges to not carry a final newline, as some ACME
       server fail to ignore it. [Michael Kaufmann (@mkauf)]
     - Fixed missing label+newline in server-status plain text output when
       MDStapling is enabled.

  *) mod_ssl: Restore support for loading PKCS#11 keys via ENGINE
     without "SSLCryptoDevice" configured.  [Joe Orton]

  *) mod_authnz_ldap: Fix possible memory corruption if the
     AuthLDAPSubGroupAttribute directive is configured.  [Joe Orton]  

  *) mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.
     PR 69203. [Yann Ylavic]

  *) mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten [P] URLs,
     including "unix:" ones.  PR 69235, PR 69260.  [Yann Ylavic, Ruediger Pluem]

  *) mod_rewrite: Error out in case a RewriteRule in directory context uses the
     proxy, but mod_proxy is not loaded. PR 56264.
     [Christophe Jaillet, Michael Streeter <mstreeter1@gmail.com>]

  *) http: Remove support for Request-Range header sent by Navigator 2-3 and
     MSIE 3. [Stefan Fritsch]

  *) mod_rewrite: Don't require [UNC] flag to preserve a leading //
     added by applying the perdir prefix to the substitution.
     [Ruediger Pluem, Eric Covener]

  *) Windows: Restore the ability to "Include" configuration files on UNC
     paths. PR 69313 [Eric Covener]

  *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
     in <Location> (incomplete fix in 2.4.62). PR 69160. [Yann Ylavic]

  *) mod_md: update to version 2.4.28
     - When the server starts, it looks for new, staged certificates to
       activate. If the staged set of files in 'md/staging/<domain>' is messed
       up, this could prevent further renewals to happen. Now, when the staging
       set is present, but could not be activated due to an error, purge the
       whole directory. [icing]
     - Fix certificate retrieval on ACME renewal to not require a 'Location:'
       header returned by the ACME CA. This was the way it was done in ACME
       before it became an IETF standard. Let's Encrypt still supports this,
       but other CAs do not. [icing]
     - Restore compatibility with OpenSSL < 1.1. [ylavic]

  *) mod_tls: removed the experimental module. It now is availble standalone
     from https://github.com/icing/mod_tls. The rustls provided API is not
     stable and does not align with the httpd release cycle.
     [Stefan Eissing]

  *) mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.
     PR 69197. [Yann Ylavic, Eric Covener]

  *) mod_http2: Return connection monitoring to the event MPM when blocking
     on client updates. [Stefan Eissing, Yann Ylavic]

Changes with Apache 2.4.62

  *) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
     mod_rewrite in server/vhost context on Windows (cve.mitre.org)
     SSRF in Apache HTTP Server on Windows with mod_rewrite in
     server/vhost context, allows to potentially leak NTML hashes to
     a malicious server via SSRF and malicious requests.
     Users are recommended to upgrade to version 2.4.62 which fixes
     this issue.
     Credits: Smi1e (DBAPPSecurity Ltd.)

  *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
     disclosure with handlers configured via AddType (cve.mitre.org)
     A partial fix for CVE-2024-39884 in the core of Apache HTTP
     Server 2.4.61 ignores some use of the legacy content-type based
     configuration of handlers. "AddType" and similar configuration,
     under some circumstances where files are requested indirectly,
     result in source code disclosure of local content. For example,
     PHP scripts may be served instead of interpreted.
     Users are recommended to upgrade to version 2.4.62, which fixes
     this issue.

  *) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
     "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
     with BalancerMember(s).  PR 69168.  [Yann Ylavic]

  *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
     PR 69160 [Yann Ylavic]

  *) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
     [Joe Orton]

  *) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
     via OpenSSL 3.x providers.  [Ingo Franzki <ifranzki linux.ibm.com>]

  *) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0.
     [Ruediger Pluem, Yann Ylavic]

  *) mpm_worker: Fix possible warning (AH00045) about children processes not
     terminating timely.  [Yann Ylavic]

Changes with Apache 2.4.61

  *) SECURITY: CVE-2024-39884: Apache HTTP Server: source code
     disclosure with handlers configured via AddType (cve.mitre.org)
     A regression in the core of Apache HTTP Server 2.4.60 ignores
     some use of the legacy content-type based configuration of
     handlers.   "AddType" and similar configuration, under some
     circumstances where files are requested indirectly, result in
     source code disclosure of local content. For example, PHP
     scripts may be served instead of interpreted.
     Users are recommended to upgrade to version 2.4.61, which fixes
     this issue.

