mod_http3 v0.0.75 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
Major changes:
- A client could open only H3MaxConcurrentStreams streams over the life of a connection: the server never gave stream credit back when a client stream closed, so the client stalled after that many requests (100 by default). Broken since v0.0.72.
Fixed vulnerabilities:
- SECURITY: HTTP/3 requests now run ap_check_request_header() and the post_read_request hooks, as HTTP/1.1 and HTTP/2 do. Before, server-level SetEnvIf and BrowserMatch, RemoteIPHeader, RequestHeader early and StrictHostCheck did not apply to HTTP/3, so a rule such as “Require not env bad_bot” could give 403 over HTTP/1.1 and 200 over HTTP/3. From apache/httpd PR #944.