Метка: http2

nghttp2 1.70.0 rpms released

nghttp2 1.70.0 rpms released and added to all supported platforms.

Major changes:

Require C++23 by @tatsuhiro-t in #2688 Adopt Designated initializers part1 by @tatsuhiro-t in #2689 Adopt Designated initializers part2 by @tatsuhiro-t in #2690 Adopt Designated initializers part3 by @tatsuhiro-t in #2691 tests: Make const values static const by @tatsuhiro-t in #2692 src: Rewrite util::split_str and its variants by @tatsuhiro-t in #2693 src: Adopt std::string::resize_and_overwrite by @tatsuhiro-t in #2694 src: Pass std::chrono::{time_point,duration} by value by @tatsuhiro-t in #2695 Bump mruby to 4.0.0 by @tatsuhiro-t in #2696 src: Fix warning «space between quotes and suffix is deprecated in C++23» by @tatsuhiro-t in #2697 lib, tests: Use C-style comment by @tatsuhiro-t in #2698 src: Avoid std::chrono::high_resolution_clock by @tatsuhiro-t in #2699 src: Add noexcept to user-defined literals by @tatsuhiro-t in #2700 src: Replace std::optional with std::expected by @tatsuhiro-t in #2701 src/util: Adopt std::expected for error handling by @tatsuhiro-t in #2702 get_socket_error: Return errno of getsockopt if it fails by @tatsuhiro-t in #2703 src: Use util::stream_error by @tatsuhiro-t in #2704 src: Get rid of std::stringstream by @tatsuhiro-t in #2705 src: Modernize Header and HeaderRef by @tatsuhiro-t in #2707 src/http2: Adopt std::expected by @tatsuhiro-t in #2708 src/tls: Adopt std::expected by @tatsuhiro-t in #2709 nghttpx: Adopt std::expected for Connection read/write by @tatsuhiro-t in #2710 Nghttpx dconn expected by @tatsuhiro-t in #2711 Nghttpx downstream expected by @tatsuhiro-t in #2712 Nghttpx http2session expected by @tatsuhiro-t in #2713 Nghttpx upstream expected by @tatsuhiro-t in #2714 Nghttpx clienthandler expected by @tatsuhiro-t in #2715 Nghttpx httpdownstreamconnection expected by @tatsuhiro-t in #2716 Nghttpx expected by @tatsuhiro-t in #2717 Nghttpx http2upstream expected by @tatsuhiro-t in #2718 Nghttpx http3upstream expected by @tatsuhiro-t in #2719 Nghttpx mruby expected by @tatsuhiro-t in #2720 Nghttpx quic expected by @tatsuhiro-t in #2721 nghttpx: Adopt std::expected for QUICConnectionHandler by @tatsuhiro-t in #2722 Nghttpx tls expected by @tatsuhiro-t in #2723 nghttpx: Rewrite time_t_from_asn1_time with ASN1_TIME_diff for boringssl by @tatsuhiro-t in #2724 Nghttpx livecheck expected by @tatsuhiro-t in #2725 Nghttpx dns expected by @tatsuhiro-t in #2726 Nghttpx memcached expected by @tatsuhiro-t in #2727 Nghttpx misc expected by @tatsuhiro-t in #2728 Nghttpx worker expected by @tatsuhiro-t in #2729 Nghttpx connhandler expected by @tatsuhiro-t in #2730 nghttpx: Pass WorkerEvent without explicit std::move by @tatsuhiro-t in #2731 nghttpx: Adopt std::expected for worker_process_event_loop by @tatsuhiro-t in #2732 nghttpx: Adopt std::expected for parse_config by @tatsuhiro-t in #2733 Nghttpx config expected by @tatsuhiro-t in #2734 Src fixup by @tatsuhiro-t in #2735 nghttpx: Adopt std::expected for main routines by @tatsuhiro-t in #2736 H2load expected by @tatsuhiro-t in #2737 nghttp: Adopt std::expected by @tatsuhiro-t in #2738 nghttpd: Adopt std::expected by @tatsuhiro-t in #2739 HtmlParser: Adopt std::expected by @tatsuhiro-t in #2740 src: Adopt size_t literal suffix by @tatsuhiro-t in #2742 nghttp: put pseudo headers before normal headers by @zhanhb in #2741 h2load: Replace std::cerr with std::print by @tatsuhiro-t in #2744 h2load: Replace std::cout with std::print by @tatsuhiro-t in #2745 nghttpx: Migrate to std::print by @tatsuhiro-t in #2746 Nghttp print by @tatsuhiro-t in #2747 Nghttpd print by @tatsuhiro-t in #2748 src: Migrate std::cout to std::print by @tatsuhiro-t in #2749 src: Simplify as_string_view usage by @tatsuhiro-t in #2750 src: Migrate fprintf to C++ counterparts by @tatsuhiro-t in #2751 src: Use std::println without argument to print just line separator by @tatsuhiro-t in #2752 nghttpx: Create CID encryption ctx per worker by @tatsuhiro-t in #2753 nghttpx: Use std::unique_ptr for quic_keying_materials_ by @tatsuhiro-t in #2754 Src optimize by @tatsuhiro-t in #2755 src: Provide faster hash functions for OpenSSL forks by @tatsuhiro-t in #2756 src: Adopt std::expected for http2::make_websocket_accept_token by @tatsuhiro-t in #2757 src: NSDMI part1 by @tatsuhiro-t in #2758 src: Add noexcept to move ctor and assignment operator by @tatsuhiro-t in #2759 build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 by @dependabot[bot] in #2760 build(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 by @dependabot[bot] in #2761 src: MSDMI part2 by @tatsuhiro-t in #2762 Avoid azure ubuntu mirror by @tatsuhiro-t in #2763 src: MSDMI part3 by @tatsuhiro-t in #2764 src/allocator: Rewrite concat_string_ref with fold expression by @tatsuhiro-t in #2765 src: Fix build failure on macos26 by @tatsuhiro-t in #2766 cmake: Remove CMAKE_CXX_STANDARD 23 that is not needed there by @tatsuhiro-t in #2767 Fix base64 oob by @tatsuhiro-t in #2768 Nghttpx upgrade by @tatsuhiro-t in #2769 Make NGHTTP2_HTTP_FLAG_* macros and make them unsigned by @tatsuhiro-t in #2770 Define flags as macros by @tatsuhiro-t in #2771 Make NGHTTP2_EXTPRI_INC_MASK unsigned by @tatsuhiro-t in #2772 src: Avoid zero-argument std::println by @kmehltretter82 in #2773 build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #2774 GHA: Add Cygwin build by @tatsuhiro-t in #2775 Fix docker build by @tatsuhiro-t in #2776 lib: Rewrite integer decoder in http by @tatsuhiro-t in #2777 Bump ngtcp2 and its dependencies by @tatsuhiro-t in #2778 Avoid deprecated ngtcp2 and nghttp3 apis by @tatsuhiro-t in #2779 net: Use macros for win32 hton*/ntoh* fallbacks by @tatsuhiro-t in #2780 lib: Add nghttp2_downcase_byte by @tatsuhiro-t in #2781 Rework HTTP header validation by @tatsuhiro-t in #2782 Bump sfparse by @tatsuhiro-t in #2783 helper: Initialize array with designated initializers by @tatsuhiro-t in #2784 Reformat downcase table by @tatsuhiro-t in #2785 http: Initialize array with designated initializers by @tatsuhiro-t in #2786 Upper case hex integer literals in huffman data table by @tatsuhiro-t in #2787 Upcase hex by @tatsuhiro-t in #2788 Nghttpx h2 stream write timeout by @tatsuhiro-t in #2789 bpf, examples, tests: Upper case hex integer literals by @tatsuhiro-t in #2790 Reformat huffman data table by @tatsuhiro-t in #2791 nghttpx: Provide frontend and backend stream timeouts by @tatsuhiro-t in #2794 build(deps): bump github.com/quic-go/quic-go from 0.59.1 to 0.60.0 by @dependabot[bot] in #2792 nghttpx: Reformat help message to make it editor friendly by @tatsuhiro-t in #2796 nghttpx: Drop connection when frontend write rate is too low by @tatsuhiro-t in #2797 build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #2799 build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2800 Bump ngtcp2 and its dependencies by @tatsuhiro-t in #2802 nghttpx: Drop h3 connection when frontend write rate is too low by @tatsuhiro-t in #2803 build(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in #2804 Gcc 16 by @tatsuhiro-t in #2805 nghttpx: NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE is not allowed in on_frame_recv_callback by @tatsuhiro-t in #2806 nghttpx: Rename completeCb_ to complete_cb_ by @tatsuhiro-t in #2807 nghttpx: Remove unused unordered_set include by @tatsuhiro-t in #2808 Require nghttp3 >= 1.17.0 by @tatsuhiro-t in #2810 Add the missing header value check for priority header field by @tatsuhiro-t in #2813 build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #2814 build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2815 Count CONTINUATIONS per its frame header by @tatsuhiro-t in #2818 build(deps): bump github.com/quic-go/quic-go from 0.60.0 to 0.61.0 by @dependabot[bot] in #2819 Bump ngtcp2 and its dependencies by @tatsuhiro-t in #2820 Bump neverbleed by @tatsuhiro-t in #2821 Bump llhttp to v9.4.2 by @tatsuhiro-t in #2822 nghttpx: Reset quic upstream addr fd to the current path by @tatsuhiro-t in #2823

NGINX 1.31.3 Mainline with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.31.3 Mainline with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

*) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533). Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

*) Security: uninitialized memory access might occur when using unnamed regex captures with the «slice» directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

*) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434). Thanks to P4P3R-HAK.

*) Change: the size of headers and trailers in HTTP/2 responses in the ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with «proxy_buffer_size» and «grpc_buffer_size» directives.

*) Change: loading of external entities is now disabled in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the «xml_external_entities» directive in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.

*) Feature: the «proxy_socket_sndbuf», «proxy_socket_rcvbuf», «fastcgi_socket_sndbuf», «fastcgi_socket_rcvbuf», «grpc_socket_sndbuf», «grpc_socket_rcvbuf», «scgi_socket_sndbuf», «scgi_socket_rcvbuf», «uwsgi_socket_sndbuf», «uwsgi_socket_rcvbuf», «tunnel_socket_sndbuf», and «tunnel_socket_rcvbuf» directives.

*) Feature: cache line size detection for loongarch64. Thanks to Miao Wang.

*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order pseudo-headers.

*) Bugfix: in flow control in the ngx_http_v2_module.

*) Bugfix: «[error] upstream sent frame for unknown stream» and «[crit] cache file … contains invalid header» messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the «proxy_cache_revalidate» directive was used.

*) Bugfix: nginx might send the «Upgrade» header line in HTTP/2 and HTTP/3 responses.

*) Bugfix: in the ngx_http_perl_module. Thanks to Maxim Dounin.

*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.

*) Bugfix: in the ngx_http_auth_basic_module on Solaris.

*) Bugfixes and improvements in the ngx_http_tunnel_module.

NGINX 1.30.4 Stable with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.30.4 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

    *) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; 
       a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533).
       Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

    *) Security: uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).

    *) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434).
       Thanks to P4P3R-HAK.

NGINX 1.30.3 Stable with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.30.3 Stable with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142)  added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

  • Security: a heap memory buffer overflow might occur in a worker
  • Security: a heap memory buffer overread might occur in a worker

NGINX 1.31.2 Mainline with Brotli, TLS 1.3, OpenSSL 4.0.1, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.31.2 Mainline with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142) added to EL7, EL8, EL9 and EL10 repositories. Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.1 with QUIC support.

Major changes:

  • Security: use-after-free might occur when using HTTP/3 and processing
  • Security: a heap memory buffer overflow might occur in a worker
  • Security: a heap memory buffer overread might occur in a worker
  • Change: now the $request_id variable uses SipHash-2-4.
  • Feature: the $ssl_sigalgs variable.
  • Bugfix: a variable defined by the «split_clients» directive might be constant time «secure_link» hash comparison.

Apache httpd 2.4.68 with Brotli support, TLS 1.3, OpenSSL 4.0.0 with http2 mod_http2 2.0.42 and ALPN for Red Hat Enterprise Linux, CentOS 7, Alma Linux, Rocky Linux 8/9/10

Apache httpd 2.4.68 RPMs released and added to all supported platforms.

Major changes:

 *) SECURITY: CVE-2026-49975: mod_http2 denial of service
     (cve.mitre.org)
     Memory Allocation with Excessive Size Value vulnerability in
     Apache HTTP Server's mod_http leads to denial of service via
     malicious HTTP requests.
     This issue affects Apache HTTP Server: from 2.4.17 through
     2.4.67.
     Credits: Quang Luong of Calif.IO in collaboration with OpenAI
     Codex

  *) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
     handles exhausted (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server module
     mod_http2 when file handles are already exhausted.
     This issue affects Apache HTTP Server: from 2.4.55 through
     2.4.67.
     Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)

  *) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
     Signed Char Overflow (cve.mitre.org)
     Buffer Underwrite vulnerability in Apache HTTP Server on crafted
     regular expressions in the configuration.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
     mod_proxy_ftp (cve.mitre.org)
     Loop with Unreachable Exit Condition ('Infinite Loop')
     vulnerability in the mod_proxy_ftp module in Apache HTTP Server
     with an attacker controlled backend FTP server.
     This issue affects undefined: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
     `send_request` (cve.mitre.org)
     Buffer Over-read vulnerability in Apache HTTP Server via
     outbound OCSP requests to an attacker controlled OCSP server
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44119: escalation of privilege through
     expressions in .htaccess in multiple modules (cve.mitre.org)
     Improper Privilege Management vulnerability in Apache HTTP
     Server 2.4.67 and earlier allows local .htaccess authors to read
     files with the privileges of the httpd user.
     This issue affects Apache HTTP Server: from through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
     can cause crash (cve.mitre.org)
     Out-of-bounds Read vulnerability in Apache HTTP Server with
     mod_headers and mod_mime and multiple response languages.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
     (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache HTTP Server
     withВ mod_xml2enc, xml2StartParse, and untrusted content
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
     (cve.mitre.org)
     A path handling issue in mod_dav_fs in Apache 2.4.67 and
     earlierВ allows a WebDAV content author to directly manipulate
     trusted DAV property databases, potentially causing child
     process crashes.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
     overflow (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache HTTP Server
     with malicious backend servers and ProxyPassReverseCookie*
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Arkadi Vainbrand

  *) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
     (cve.mitre.org)
     A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
     and earlier allows an attack by an untrusted backend.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Elhanan Haenel

  *) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
     A cross-site scripting vulnerability exists in mod_proxy_ftp's
     HTML directory list generation in Apache HTTP Server 2.4.67 and
     earlier when listing FTP directory contents either via forward
     or reverse proxy configuration.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
     (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server with mod_ldap
     in per-directory configuration
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) mod_ssl, ab: Add support for OpenSSL 4.0.  [Joe Orton]

  *) mod_ssl: Add SerialNumber as a recognized attribute type for SSL
     distinguished name variables.  [Michael Osipov <michaelo apache.org>,
     Benjamin Demarteau <benjamin.demarteau liege.be>]

  *) mod_ssl: Set auth type to "ClientCert" when client certificate authentication
     has been performed.  [Michael Osipov <michaelo apache.org>]

  *) mod_include: Don't print any of if/elsif/else content when
     a conditional evaluation returns an error. [Eric Covener]

  *) mod_unixd: CoreDumpDirectory requires enabling tracing on FreeBSD 11+.
     PR 65819.  [David CARLIER <devnexen gmail.com>]

  *) mod_file_cache: Fix crashes for mmap'ed files under threaded
     MPMs. PR 69901. barr.israel <barr.israel campus.technion.ac.il>

  *) core: Add support for %{m}t in ErrorLogFormat to log milli-second
     time resolution (in addition to existing %{u}t for micro-seconds).
     [LuboЕЎ Uhliarik <luhliari redhat.com>]

  *) mod_unixd: Drop test that effective user ID is zero in
     a chroot configuration.  PR 69767.
     [Bastien Roucaries <rouca debian.org>]

  *) mod_proxy_balancer: Include nonce in XML output.  PR 63074.
     Federico Mennite <federico.mennite lifeware.ch>

  *) mod_http2: update to version 2.0.42
     Fix excessive file description use for non-TLS frontend connections when
     sending files. Fixes <https://github.com/icing/mod_h2/issues/325>
     [Stefan Eissing]

  *) mod_http2: update to version 2.0.41
     Fix cookie header accounting against LimitRequestFields.
     [Stefan Eissing]

  *) mod_http2: update to version 2.0.40
     Fix error handling on upload requests when server runs out of file
     handles that left beam bucket callbacks in place, potentially using
     no longer valid references. Only applies on platforms with pipes
     and file descriptor limits not healthy for a network server.
     [Stefan Eissing]

  *) mod_dav_fs: Return a 404 for DELETE if deletion fails because the
     resource no longer exists.  PR 60746.  [Joe Orton]

  *) mod_proxy_hcheck: Fix healthcheck disabled due to child restart while
     updating. [Yann Ylavic]

Fixed vulnerabilities:

— SECURITY: CVE-2026-49975: mod_http2 denial of service — SECURITY: CVE-2026-48913: mod_http2 memory corruption when file — SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via — SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in — SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP — SECURITY: CVE-2026-44119: escalation of privilege through — SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers` — SECURITY: CVE-2026-42536: mod_xml2enc heap overflow — SECURITY: CVE-2026-42535: mod_dav_fs protected directory access — SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer — SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow — SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org) — SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free

HTTP/2 Bomb: why Apache httpd users should update mod_http2

A new HTTP/2 denial-of-service technique, called HTTP/2 Bomb, was publicly described by Calif on June 2, 2026. The attack abuses a combination of HTTP/2 header compression behavior and stalled response flow control to make a server allocate and hold a large amount of memory from a very small amount of network traffic. According to the research, the issue affects several major HTTP/2 implementations, including Apache httpd, nginx, Microsoft IIS, Envoy, and Cloudflare Pingora.

For Apache httpd, the vulnerable component is mod_http2. The researchers reported that Apache httpd could reach very high memory amplification under this attack pattern, because repeated HTTP/2 cookie header fragments were not counted correctly against request header limits. The public mitigation note says that the Apache-side fix is available in mod_http2 2.0.41 and later, while it was not yet part of an Apache httpd 2.4.x release at the time of publication.

The important practical detail is that you do not need to wait for a full Apache httpd package update if your distribution provides mod_http2 as a separate package. In the CodeIT repository, the update is already available separately from the main httpd package. The fix was included by the upstream mod_http2 authors in 2.0.41, and the CodeIT repository already provides the newer mod_http2 2.0.42 package. GitHub release notes for mod_http2 confirm that 2.0.41 fixed cookie header accounting against LimitRequestFields, while 2.0.42 is the latest following release.

What should administrators do?

If you use Apache httpd with HTTP/2 enabled on RHEL, AlmaLinux, Rocky Linux, Oracle Linux, CentOS, or compatible Enterprise Linux systems, update the mod_http2 package from the CodeIT repository:

dnf update mod_http2

or on older systems:

yum update mod_http2

Then reload or restart Apache httpd:

systemctl restart httpd

You can verify the installed package version with:

rpm -q mod_http2

The expected safe version in the CodeIT repository is 2.0.42 or newer.

Temporary mitigation

If you cannot update immediately, the safest temporary mitigation is to disable HTTP/2 and serve traffic over HTTP/1.1 only. For Apache httpd this can be done by removing h2 from the Protocols directive, for example:

Protocols http/1.1

However, disabling HTTP/2 is only a workaround. The recommended solution is to update mod_http2.

CodeIT repository status

CodeIT packages are built for Enterprise Linux systems that need modern web server components while keeping a stable operating system base. The HTTP/2 Bomb fix is already available in the CodeIT repository through mod_http2 2.0.42, independently from the main Apache httpd package. This allows administrators to patch the HTTP/2 module quickly without waiting for the next full httpd release cycle.

mod_http2 v2.0.40 rpms released

mod_http2 v2.0.40 rpms released and added to all supported platforms.

Changes:

  • Fix error handling on upload requests when server runs out of file handles that left beam bucket callbacks in place, potentially using no longer valid references. Only applies on platforms with pipes and file descriptor limits not healthy for a network server.