mod_http3 v0.0.70 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
Major changes:
- Advertised a QPACK dynamic table, sized by H3QpackTableCapacity and H3QpackBlockedStreams, so request headers compress as they do over HTTP/2.
- Made the request worker pool tunable with H3MinWorkers, H3MaxWorkers and H3MaxWorkerIdleSeconds instead of a fixed 16 to 64 threads.
- Added H3StreamTimeout, so a client that stops reading can no longer park a request worker until it goes away.
- Added H3MaxStreamErrors, closing a connection whose client keeps sending malformed requests instead of answering them forever.
- Published the mod_ssl TLS environment (SSL_PROTOCOL, SSL_CIPHER and friends) for HTTP/3 requests, which mod_ssl does not manage.
- Added H3SessionTickets, so an operator can control whether returning clients resume instead of running a full handshake.
- Added H3SocketBufferSize, so the QUIC socket no longer drops datagrams from an undersized OS receive buffer once a connection runs at speed.
- Enforced H3IdleTimeout in the module event loop, so a connection with no requests is closed instead of being held open by QUIC keepalive pings.
- Rejected a malformed HTTP/3 request with a stream error instead of closing the connection, so requests in flight beside it survive.
- Build against httpd 2.4.x as well as trunk; response buckets and the child_stopped hook are now selected at compile time.
- Detect the stable or devel httpd at configure time and backport the graceful drain to the 2.4.x branch.
Fixed vulnerabilities:
- SECURITY: Updated the httpd submodule so mpm_event tolerates a connection it never accepted, ending a child crash on an ErrorDocument over HTTP/3.
- SECURITY: Applied LimitRequestFields and LimitRequestFieldSize to HTTP/3, so a client can no longer grow a stream’s memory with unbounded headers.