Apache httpd 2.4.71 has been added to the CodeIT repository, built with HTTP/2 (mod_http2), Brotli, TLS 1.3 and ALPN, against OpenSSL 4.0.3. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
mod_http2 in the RPM packages is now built from the httpd source tree, the way the DEB packages and Ubuntu’s own apache2 already do, instead of from the separate mod_h2 project. The package keeps its name, mod_http2, and now carries the httpd version, so dnf or yum upgrade from mod_http2 2.0.42 to it on their own: nothing has to be removed first, and an edited 10-h2.conf is kept.
HTTP/3 is available for this httpd through mod_http3, an experimental module packaged separately:
- RPM, EL8 and later: dnf install mod_http3
- RPM, EL7: yum install mod_http3
- DEB: apt install libapache2-mod-http3
The module is loaded as soon as it is installed; HTTP/3 itself is enabled per virtual host. Edit the example vhost the package installs (ServerName and certificate): on EL it is /etc/httpd/vhosts.d/http3-vhost.conf, which httpd.conf does not include by default, so add IncludeOptional vhosts.d/*.conf; on Ubuntu run a2ensite http3-vhost. Then reload httpd and open 443/udp in the firewall, since QUIC runs over UDP.
Major changes:
- mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain. New directive MDHttpProxyCACertificateFile sets the CA certificates used to verify an HTTPS proxy.
- mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a length byte with the high bit set is no longer sign-extended, fixing inflation of gzip streams that carry an extra field.
- mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host they are configured in, and merge the proxy entries of the main server and of the virtual host, logging a warning when both have some. PR 70207.
- mod_dav: Fix handling of invalid or overflowing “Timeout:” request headers, which could silently grant a lock with an already-expired timeout instead of the RFC 4918 maximum. PR 65788
- mod_http2: Correctly handle the asterisk-form of OPTIONS requests instead of rejecting them as malformed. PR 70195.
- mod_http2: Fix duplicate logging of header limit violations.
- mod_http2: Fix a crash creating an HTTP/2 session with “H2PushDiarySize 0” and debug logging enabled.
- mod_dav_lock: Fix dav_generic_load_lock_record() reading the indirect-lock key length with the wrong width, which could read back a wrong length on big-endian platforms. PR 70299
- mod_remoteip: Log a connection closed before a complete PROXY protocol header was received at info level rather than as an error. PR 63893.
Fixed vulnerabilities:
- SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in assign_headers. Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
- SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292). Stack-based buffer overflow vulnerability in Apache HTTP Server’s mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69 and 2.4.70.
- SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads to child process crash. NULL pointer dereference vulnerability in Apache HTTP Server’s mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.70.