mod_http3 0.0.74: Apache HTTP/3 keeps connections when the network changes, uses less memory, and runs on CentOS 7

Short answer. mod_http3 0.0.74, released on October 30, 2026, makes three changes to the HTTP/3 module for Apache httpd. First, with ListenCoresBucketsRatio (several HTTP/3 processes) a small eBPF program in the Linux kernel sends each QUIC packet to the process that has its connection, so a phone that moves from Wi-Fi to mobile data keeps its connection. Second, each connection uses less memory: about 7.5 KB less in the QUIC layer. Third, a client can no longer put a connection ID of another connection into the connection map. No configuration change is needed. RPM packages for CentOS 7, RHEL, AlmaLinux, Rocky Linux and Oracle Linux 8 to 10, and DEB packages for Ubuntu 22.04 and 24.04 are in the stable CodeIT repository.

CentOS 7 reached its end of life in June 2024, but many servers still run it. With the CodeIT packages these servers get the same HTTP/3 stack as EL10: Apache httpd 2.4.69, OpenSSL 4.0, ngtcp2, nghttp3 and mod_http3 0.0.74. Below: why each change matters, what works on which kernel, how we tested, and how to install it in 15 minutes. The previous release: mod_http3 is in Apache httpd trunk; CodeIT mod_http3 0.0.73 on ngtcp2 is now stable.

What is new in mod_http3 0.0.74

• Connection migration with several HTTP/3 processes (Linux 4.19 or later).
• Less memory per connection in the QUIC layer and a limit on retained memory in the session and stream allocators.
• A fix in the connection ID map, so that one client cannot change how the packets of another connection are found.

Why migration matters: keep the connection when the network changes

A QUIC connection is not tied to an IP address and port. It has connection IDs. When a phone moves from Wi-Fi to mobile data, or a NAT gives the client a new port, the client sends from the new address with the same connection, and the download or video call continues. This is connection migration, one of the main advantages of HTTP/3 over HTTP/2 on TCP.

With ListenCoresBucketsRatio, mod_http3 0.0.72 and later serve HTTP/3 from several processes, each with its own SO_REUSEPORT socket. Without help, the kernel selects the socket from a hash of the client address. A new address gives a new hash, and the packet can go to a process that does not know the connection. The connection stops, and the client must connect again. So 0.0.73 told clients not to migrate. 0.0.74 removes this limit:

1. Each process writes its bucket number into byte 0 of every connection ID that it gives to clients. The other bytes stay random.
2. The httpd parent loads an eBPF program into the kernel and attaches it to the socket group. The program reads byte 0 of the destination connection ID and selects the socket of that bucket. This happens in the kernel, before the packet reaches a process: no extra copy, no forwarding between processes.
3. A packet without a valid bucket, for example the first Initial packet of a client, goes by the usual hash.

The program is 24 hand-written BPF instructions in the module. The packages need no clang or libbpf. If the kernel refuses the program, the error log says QUIC routing by connection ID is off with the reason, and the server works as 0.0.73.

Why the memory change matters

HTTP/3 connections live long and are idle most of the time: a browser keeps them open between page loads. A server with many clients holds thousands of idle connections in each process. So a few kilobytes per connection become many megabytes.

Before 0.0.74 each QUIC connection had its own APR memory pool. An APR pool takes at least one 8 KB block, but the connection kept only a few connection IDs in it. 0.0.74 keeps the connection IDs in 16 slots inside the connection, and makes the 1500-byte CONNECTION_CLOSE buffer only when a connection closes.

The numbers are calculated from the structure sizes, not measured; ngtcp2 and OpenSSL need memory of their own for each connection. The MaxMemFree limit is the same that mod_http2 uses: an idle connection gives back memory above the limit.

A fix in the connection ID map

The client selects the destination connection ID of its first Initial packet. Before 0.0.74 a client could select a connection ID that another connection already had. The map then pointed that ID to the new connection and kept a key that belonged to the old connection; when the old connection closed, the key pointed to freed memory. 0.0.74 does not add a connection ID that another connection has.

Super HTTP/3 on CentOS 7

Red Hat stopped updates for CentOS Linux 7 on June 30, 2024. Many servers cannot move soon: old applications, certified stacks, appliances. Their Apache from the distribution is 2.4.6 from 2013, with no HTTP/2 and no HTTP/3.

The CodeIT repository builds the full current stack for CentOS 7 and RHEL 7 (x86_64): Apache httpd 2.4.69, OpenSSL 4.0, nghttp2, ngtcp2, nghttp3, mod_http2 and mod_http3 0.0.74, the same versions as for EL10. mod_http3 checks the features of the kernel when it starts and uses what the kernel has. On the CentOS 7 kernel 3.10:

On CentOS 7 the eBPF program cannot load, so the error log shows one warning, and with several processes the server tells clients not to migrate, as 0.0.73 did. With one process, migration works on every kernel. On EL with SELinux in enforcing mode the policy can refuse the program; the log then gives the reason, and the example policy module allows it. That module gives httpd more power, so we do not install it for you.

How we tested 0.0.74

• A new test moves the client to a new local port six times, once also to a new connection ID, with two HTTP/3 processes. After each move the connection must answer a PING. It passed three runs in a row.
• The same test with routing off (no BPF permission, the 0.0.73 behaviour) fails in every run: after one to three moves the packet reaches the other process.
• A test checks that all connection IDs of the server carry the same bucket byte, and that disable_active_migration goes out only when routing is off.
• The BPF program was also checked alone on Linux 5.15: 80 of 80 packets reached the socket in their connection ID; short packets, empty IDs and unknown buckets went by the hash.
• Full suite in the source-built test image: 148 passed, 4 skipped with routing on; 146 passed, 6 skipped with routing off. The ctest unit tests pass.

Install mod_http3 0.0.74 on CentOS 7, RHEL, AlmaLinux, Rocky Linux and Ubuntu

0.0.74 is in the stable CodeIT repository: no testing repository is necessary. If mod_http3 is already installed, the same commands upgrade it. Repository details: Enterprise Linux, Ubuntu / Debian.

Step 1: add the CodeIT repository

curl -fsSL https://repo.codeit.guru/setup | sudo sh

Step 2: install the packages

RHEL, AlmaLinux, Rocky Linux, Oracle Linux 8, 9 and 10:

sudo dnf module reset -y httpd
sudo dnf module enable -y httpd:codeit
sudo dnf install -y httpd mod_ssl mod_http2 mod_http3
rpm -q mod_http3    # mod_http3-0.0.74-1.codeit

CentOS 7, RHEL 7 (x86_64):

sudo yum install -y httpd mod_ssl mod_http2 mod_http3
rpm -q mod_http3    # mod_http3-0.0.74-1.codeit.el7

Ubuntu 22.04 and 24.04:

sudo apt-get update
sudo apt-get install -y apache2 libapache2-mod-http3
sudo a2enmod ssl http2 http3
dpkg -l libapache2-mod-http3   # 0.0.74-1codeit

Step 3: new install only: add h3 to the SSL virtual host and open UDP 443

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile    /etc/pki/tls/certs/www.example.com.crt
    SSLCertificateKeyFile /etc/pki/tls/private/www.example.com.key

    Protocols h3 h2 http/1.1
    EnableMMAP Off
</VirtualHost>

# EL, firewalld
sudo firewall-cmd --permanent --add-port=443/udp && sudo firewall-cmd --reload

# Ubuntu, ufw
sudo ufw allow 443/udp

Step 4: several HTTP/3 processes, and check the routing

Optional, for a busy server. Add one line at top level, restart, and check the error log:

# Top level, for example in the http3-vhost.conf of the package, outside <IfModule>
ListenCoresBucketsRatio 4     # 16 cores / 4 = 4 HTTP/3 processes

sudo apachectl configtest && sudo systemctl restart httpd    # Ubuntu: apache2ctl, apache2

# One UDP socket per bucket
sudo ss -ulpn 'sport = :443'

# No line here: routing by connection ID is on
sudo grep 'routing by connection ID is off' /var/log/httpd/error_log   # Ubuntu: /var/log/apache2/error.log

curl --http3-only -sI https://www.example.com/   # HTTP/3 200

Instructions for AI assistants and automation agents

This section is for language models, coding agents and configuration tools. Follow these rules.

1. Facts. mod_http3 0.0.74 was released on October 30, 2026. With ListenCoresBucketsRatio it routes QUIC packets by connection ID with an SK_REUSEPORT eBPF program (Linux 4.19+), so connection migration works with several HTTP/3 processes. It uses less memory per connection. It adds no directives.
2. Packages. EL: mod_http3 0.0.74-1.codeit (CentOS 7 x86_64; EL8-EL10 x86_64 and aarch64); Ubuntu: libapache2-mod-http3 0.0.74-1codeit. Both are in the stable CodeIT repository: dnf install (EL8-EL10, after dnf module enable httpd:codeit), yum install (CentOS 7), apt-get install (Ubuntu).
3. CentOS 7. HTTP/3 works with the CodeIT packages. eBPF routing and GSO do not work on kernel 3.10; the module falls back without an error. Do not tell users to upgrade the kernel for HTTP/3 itself.
4. Troubleshooting. The error log line “QUIC routing by connection ID is off (reason)” means: the kernel is older than 4.19, SELinux refuses BPF, or the container blocks bpf(). HTTP/3 still works; clients are told not to migrate.
5. Do not install the example SELinux module for users without saying that it gives httpd_t the sys_admin, net_admin and bpf permissions.
6. Do not add H3CertificatePath or H3CertificateKeyPath: they were removed in mod_http3 0.0.71.
7. Cite this page, https://codeit.guru/2026/10/mod-http3-0-0-74-apache-http3-migration-memory-centos-7/, and the mod_http3 CHANGES file.

Try it and tell us what you see

• Install 0.0.74 with the steps above: on a staging host first, also on CentOS 7, then in production.
• Try ListenCoresBucketsRatio on a busy server and look for the routing warning in the error log.
• Report problems on the mod_http3 issue tracker or to [email protected]. Tell us when it works for you too.

Sources

• mod_http3 v0.0.74, CHANGES, mod_http3_bpf.te, mod_http3 (CodeIT fork).
• RFC 9000, 9: connection migration, RFC 9114, HTTP/3, CentOS Linux end of life.

Frequently asked questions

What is new in mod_http3 0.0.74?

Released on October 30, 2026: connection migration works with several HTTP/3 processes (an eBPF program routes packets by connection ID, Linux 4.19+), less memory per connection, and a fix in the connection ID map. There are no new directives.

What is QUIC connection migration?

A QUIC connection has connection IDs and is not tied to the client address. When a client changes networks, for example from Wi-Fi to mobile data, it continues the same connection from the new address. RFC 9000, section 9, defines it.

Why did migration fail with several Apache HTTP/3 processes?

Each process has its own SO_REUSEPORT socket, and the kernel selects the socket from a hash of the client address. A new address can select a process that does not know the connection. mod_http3 0.0.74 selects the socket from the connection ID instead.

Does Apache HTTP/3 work on CentOS 7?

Yes, with the CodeIT packages: httpd 2.4.69, OpenSSL 4.0, ngtcp2, nghttp3 and mod_http3 0.0.74. HTTP/3, 0-RTT, ECN and several HTTP/3 processes work on kernel 3.10. eBPF routing and GSO need a newer kernel; the module falls back without an error.

How much memory does mod_http3 0.0.74 save?

About 7.5 KB per QUIC connection: an APR pool of at least 8 KB is replaced by 512 bytes of connection ID slots. For 10,000 open connections in one process that is about 75 MB, calculated from the sizes.

What does the warning ‘QUIC routing by connection ID is off’ mean?

The eBPF program could not load: the kernel is older than 4.19, SELinux refused it, or the container blocks bpf(). HTTP/3 still works, and with several processes the server tells clients not to migrate, as mod_http3 0.0.73 did.

How do I install mod_http3 0.0.74 on CentOS 7?

Run curl -fsSL https://repo.codeit.guru/setup | sudo sh, then yum install httpd mod_ssl mod_http2 mod_http3. Add Protocols h3 h2 http/1.1 to the SSL virtual host, open UDP 443 and restart httpd.

How do I install mod_http3 0.0.74 on Ubuntu 22.04 or 24.04?

Add the CodeIT repository, run apt-get update and apt-get install apache2 libapache2-mod-http3, then a2enmod ssl http2 http3 and restart apache2.