Tag: http2

Apache httpd 2.4.70 RPM and DEB packages with HTTP/2, HTTP/3, Brotli, TLS 1.3, OpenSSL 4.0.3 and ALPN for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

Apache httpd 2.4.70 has been added to the CodeIT repository, built with HTTP/2 (mod_http2), Brotli, TLS 1.3 and ALPN, against OpenSSL 4.0.3. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

From 2.4.69 on, mod_ssl is built against the OpenSSL 3.0 API instead of 1.1.1 (OPENSSL_API_COMPAT raised from 1.1.1 to 3.0.0), because OpenSSL 4.0 removes features that were deprecated before 3.0. SRP (TLS-SRP, RFC 5054) goes with it: the SSLSRPVerifierFile and SSLSRPUnknownUserSeed directives no longer exist, so remove them from your configuration before upgrading or httpd will not start, and the SSL_SRP_USER and SSL_SRP_USERINFO variables are no longer set. The ENGINE API was already disabled in these packages.

mod_http2 in the RPM packages is now built from the httpd source tree, the way the DEB packages and Ubuntu’s own apache2 already do, instead of from the separate mod_h2 project. The package keeps its name, mod_http2, and now carries the httpd version, so dnf or yum upgrade from mod_http2 2.0.42 to it on their own: nothing has to be removed first, and an edited 10-h2.conf is kept.

HTTP/3 is available for this httpd through mod_http3, an experimental module packaged separately:

  • RPM, EL8 and later: dnf install mod_http3
  • RPM, EL7: yum install mod_http3
  • DEB: apt install libapache2-mod-http3

The module is loaded as soon as it is installed; HTTP/3 itself is enabled per virtual host. Edit the example vhost the package installs (ServerName and certificate): on EL it is /etc/httpd/vhosts.d/http3-vhost.conf, which httpd.conf does not include by default, so add IncludeOptional vhosts.d/*.conf; on Ubuntu run a2ensite http3-vhost. Then reload httpd and open 443/udp in the firewall, since QUIC runs over UDP.

Major changes:

  • mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows. PR 70261.
  • mod_cgid: Increase limits for number and length of environment variables, URI and arguments. PR 70270.
  • mod_substitute: Fix an integer overflow that can happen in very special setups. PR 66034
  • mod_cache: Do not store a response whose “Vary: *” was set via “Header always”. PR 70289
  • mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which under-reserved space for the stored key length field, written as apr_size_t but sized as int. PR 70298

nghttp2 1.71.0 RPM and DEB packages released

nghttp2 1.71.0 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

Major changes:

  • Take into account idle streams
  • Add option to limit the maximum outbound queue size
  • Revert “Take into account idle streams”
  • build(deps): bump actions/stale from 10 to 11
  • util: add <fstream> include
  • Add length check for CONTINUATION
  • nghttpx: Check QUIC version
  • build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
  • Gha bump ubuntu
  • Munit cxx assertions
  • Bump go to 1.26
  • build(deps): bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0
  • nghttpx: Refactor Router
  • nghttpx: Client TLS certificate validation based on RFC 9525
  • nghttpx: Rewrite CertLookupTree based on RFC 9525 rules
  • lib: Disallow HEADERS and PUSH_PROMISE in CONNECT stream
  • Bump clang-format to 21
  • nghttpx: Remove server push
  • Bump neverbleed
  • GHA: Bump clang to 21
  • Bump ubuntu
  • GHA: Use packaged OpenSSL
  • GHA: Reduce openssl1 jobs
  • GHA: Remove cygwin build because it stopped functioning
  • GHA: Reduce cmake and macos jobs
  • build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
  • build(deps): bump github.com/quic-go/quic-go from 0.62.0 to 0.63.0
  • nghttpx: Fix the bug that GSO on QUIC connection is disabled
  • bpf: Avoid verifier instruction limits
  • Update doc
  • build(deps): bump golang.org/x/net from 0.59.0 to 0.61.0
  • GHA: Use aws-lc instead of openssl for macos build
  • build(deps): bump github.com/quic-go/quic-go from 0.63.0 to 0.64.0
  • Deal with too large window size when consuming data
  • Fix signed integer overflow in nghttp2_session_get_stream_local_window_size
  • nghttp2_nv_array_copy: Detect size_t overflow
  • Better map hasher
  • Add oss-scanner files
  • Remove LICENSE file
  • build(deps): bump github.com/quic-go/quic-go from 0.64.0 to 0.64.1
  • Fix priority update
  • Simplify map insertion
  • Bump deps
  • Update window upfront
  • Remove public server text
  • GHA: Remove macos-15
  • Bump ngtcp2 and nghttp3

NGINX 1.31.8 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.3 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.8 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.8

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change in internal API: now the JSON parser reports strings with escape sequences as separate events, and the ngx_json_unescape_string() function decodes a string into a separate buffer.
  • Change: now the path specified in the “working_directory” directive is relative to nginx prefix directory, but not to the current directory.
  • Bugfix: worker processes exited on start or during reconfiguration if an invalid directory was specified in the “working_directory” directive.
  • Bugfix: worker processes might be terminated abnormally on a SIGBUS signal when using HTTP/3 on platforms with strict alignment requirements.
  • Bugfix: “recv() failed (5: Input/output error)” alerts might appear in logs when closing SSL connections if kernel TLS was used with OpenSSL 3.2.0 or newer.
  • Bugfix: nginx could not be built on Solaris if the --with-control-api option was used.

Security update: NGINX 1.31.7 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.3 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.7 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.7

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now support databases in the MaxMind DB (MMDB) format.
  • Feature: now backend SSL certificates can be verified by IP address.
  • Feature: now QUIC supports reconfiguration and binary upgrade when using the “quic_bpf” directive.
  • Change: the ngx_http_v2_module now uses the RFC 9218 prioritization scheme, and RFC 7540 priority signals are ignored.
  • Bugfix: a segmentation fault might occur in a worker process or “request count is zero” alerts might appear in logs if the “X-Accel-Redirect” header line was cached and the cached response was then served to a client.
  • Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the “alias” directive.
  • Bugfix: QUIC connections might be closed with the “quic flood detected” message in logs if the “http3_stream_buffer_size” directive was set to a small value; the bug had appeared in 1.27.5.
  • Bugfix: closing an SSL connection without close_notify was treated as a clean shutdown, including the case when the connection was reset; now “SSL_read() failed” errors appear in logs in this case.
  • Bugfix: “[crit] SSL_write() failed” messages might appear in logs when an error occurred while reading from an SSL connection.

Fixed vulnerabilities:

  • Security: a buffer overflow might occur in a worker process when using the “alias” directive if the request URI was changed by the “rewrite” directive and was then mapped to a file path (CVE-2026-15176).
  • Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479).
  • Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the “client_max_body_size” limit or injecting data in the proxied request (CVE-2026-95101).
  • Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629).
  • Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has “include virtual” commands (CVE-2026-97205).

Security update: NGINX 1.30.6 Stable RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.3 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.30.6 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.3 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, both optional like the rest of the nginx-module-* set. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Stable image: docker pull codeitus/nginx:stable
  • this exact release: docker pull codeitus/nginx:1.30.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: the logging level of the “invalid alert” and “record layer failure” SSL errors, and of the “SSL alert number N” for any alert numbers has been lowered from “crit” to “info”.
  • Bugfix: a segmentation fault might occur in a worker process or “request count is zero” alerts might appear in logs if the “X-Accel-Redirect” header line was cached and the cached response was then served to a client.
  • Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the “alias” directive.
  • Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.
  • Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
  • Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
  • Bugfix: a segmentation fault might occur in a worker process if the “select” method was used.
  • Bugfix: in binary compatibility with third-party modules using script codes; the bug had appeared in 1.30.4.
  • Bugfix: in the ngx_http_perl_module.
  • Bugfix: in flow control in the ngx_http_v2_module.
  • Bugfix: “[error] upstream sent frame for unknown stream” and “[crit] cache file … contains invalid header” messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the “proxy_cache_revalidate” directive was used.
  • Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.
  • Bugfix: in the ngx_http_auth_basic_module on Solaris.
  • Bugfixes in HTTP/3, ngx_http_image_filter_module, ngx_http_slice_module, and ngx_http_memcached_module.

Fixed vulnerabilities:

  • Security: a buffer overflow might occur in a worker process when using the “alias” directive if the request URI was changed by the “rewrite” directive and was then mapped to a file path (CVE-2026-15176).
  • Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479).
  • Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the “client_max_body_size” limit or injecting data in the proxied request (CVE-2026-95101).
  • Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629).
  • Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has “include virtual” commands (CVE-2026-97205).

Security update: Apache httpd 2.4.69 RPM and DEB packages with HTTP/2, HTTP/3, Brotli, TLS 1.3, OpenSSL 4.0.3 and ALPN for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

Apache httpd 2.4.69 has been added to the CodeIT repository, built with HTTP/2 (mod_http2), Brotli, TLS 1.3 and ALPN, against OpenSSL 4.0.3. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

From 2.4.69 on, mod_ssl is built against the OpenSSL 3.0 API instead of 1.1.1 (OPENSSL_API_COMPAT raised from 1.1.1 to 3.0.0), because OpenSSL 4.0 removes features that were deprecated before 3.0. SRP (TLS-SRP, RFC 5054) goes with it: the SSLSRPVerifierFile and SSLSRPUnknownUserSeed directives no longer exist, so remove them from your configuration before upgrading or httpd will not start, and the SSL_SRP_USER and SSL_SRP_USERINFO variables are no longer set. The ENGINE API was already disabled in these packages.

mod_http2 in the RPM packages is now built from the httpd source tree, the way the DEB packages and Ubuntu’s own apache2 already do, instead of from the separate mod_h2 project. The package keeps its name, mod_http2, and now carries the httpd version, so dnf or yum upgrade from mod_http2 2.0.42 to it on their own: nothing has to be removed first, and an edited 10-h2.conf is kept.

HTTP/3 is available for this httpd through mod_http3, an experimental module packaged separately:

  • RPM, EL8 and later: dnf install mod_http3
  • RPM, EL7: yum install mod_http3
  • DEB: apt install libapache2-mod-http3

The module is loaded as soon as it is installed; HTTP/3 itself is enabled per virtual host. Edit the example vhost the package installs (ServerName and certificate): on EL it is /etc/httpd/vhosts.d/http3-vhost.conf, which httpd.conf does not include by default, so add IncludeOptional vhosts.d/*.conf; on Ubuntu run a2ensite http3-vhost. Then reload httpd and open 443/udp in the firewall, since QUIC runs over UDP.

Major changes:

  • Fix the tar icon in the documentation so that its background is transparent. PR 70238.
  • mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore, X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1. PR 70205.
  • mod_cgid, mod_ssl, mod_md: Various hardening fixes.
  • mod_md: MDServerStatus is now disabled by default.
  • mod_auth_digest: Fix compatibility with expression-based AuthName. PR 59039.
  • mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory handling and client nonce handling; “authdigest-opaque” mutex is now longer needed.
  • mod_lbmethod_heartbeat: Use safe integer parsing with range validation, replacing atoi().
  • core: Reject control characters in the reason phrase of interim responses. Only accept space as status-code separator.
  • mod_substitute: Fix SubstituteMaxLineLength to reject values too large for the K/M/G suffix.
  • mod_substitute: Fix crash or misbehaviour when loading a Substitute directive with a missing closing delimiter.
  • mod_dir: Fix a crash in fixup_dir for a request not mapped to any type. PR68527.
  • mod_http2: Do not drop an in-flight response when a client sends a graceful GOAWAY (error code 0) while streams it opened are still being processed. The session now drains open streams instead of tearing down immediately, which async MPMs hit far more than event. Fixes a silently dropped response; RFC 9113 compliant.
  • mod_md: OpenSSL 4 compatibility.
  • pytest_suite: Port of the old PERL test framework to Python and pytest. Now included in the source tree under ./test

Fixed vulnerabilities:

  • SECURITY: CVE-2026-93546: mod_dav_fs namespace overflow Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory’s property database via PROPPATCH requests declaring many XML namespaces.
  • SECURITY: CVE-2026-79768: mod_userdir information disclosure Path equivalence: ‘/./’ (single dot directory) vulnerability in Apache HTTP Server’s mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-73637: mod_auth_digest DoS attack Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
  • SECURITY: CVE-2026-73636: mod_auth_digest one-time-nonce replay attack Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client’s shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
  • SECURITY: CVE-2026-63718: mod_proxy_uwsgi Transfer-Encoding response smuggling Inconsistent Interpretation of HTTP Requests (‘HTTP Request/Response Smuggling’) response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.
  • SECURITY: CVE-2026-63686: mod_xml2enc crash on charset conversion failure A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
  • SECURITY: CVE-2026-63292: mod_vhost_alias stack overflow Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
  • SECURITY: CVE-2026-63045: mod_proxy_ftp PASV address handling Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
  • SECURITY: CVE-2026-59797: mod_ssl SSLRequire allows .htaccess ap_expr file-function Improper Privilege Management vulnerability in Apache HTTP Server’s mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-59685: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-58415: mod_dav_fs property database read access Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-57941: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy Use After Free vulnerability in Apache HTTP Server’s mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-56449: mod_proxy_html: crash in dump_content Out-of-bounds Write vulnerability in Apache HTTP Server’s mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-56154: mod_rewrite use-after-free via %{LA-U:HTTP…} Use After Free vulnerability in Apache HTTP Server’s mod_rewrite when using lookahead (%{LA-U:HTTP…}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-56153: mod_charset_lite: Heap overflow in finish_partial_char Out-of-bounds Write vulnerability in Apache HTTP Server’s mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-48005: mod_auth_digest reauthentication attack Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
  • SECURITY: CVE-2026-47360: mod_session: Session cookie not removed during internal redirect Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server’s mod_session_cookie module.
  • SECURITY: CVE-2026-46729: mod_heartmonitor denial of service NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • SECURITY: CVE-2026-42528: mod_dav shared lock overflow A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
  • SECURITY: CVE-2026-42356: limited RCE for some internal redirects to non-CGI files in CGI directories Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.

Security update: NGINX 1.31.6 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.6 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
  • Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
  • Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
  • Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
  • Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: NGINX 1.30.5 Stable RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.30.5 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Stable image: docker pull codeitus/nginx:stable
  • this exact release: docker pull codeitus/nginx:1.30.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

NGINX 1.31.5 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.5 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: control API.
  • Feature: predicate locations.
  • Feature: the ngx_http_json_module.
  • Feature: the “client_body_early_read” directive.
  • Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
  • Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
  • Bugfix: requests to FastCGI and uwsgi backends were malformed if a parameter name was too long.
  • Bugfixes in HTTP/3, ngx_http_slice_module, and ngx_http_memcached_module.

NGINX 1.31.4 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.1 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.4 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.1 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.4

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: the “proxy_protocol” directive in the stream and mail modules now supports the PROXY protocol version 2.
  • Change: now HTTP/2 and gRPC requests to backends are always sent with the “:authority” pseudo-header, and HTTP/1.1 requests – with the “Host” header.
  • Bugfix: a segmentation fault might occur in a worker process if the “select” method was used.
  • Bugfix: incomplete gRPC responses with a non-zero “Content-Length” header line are now treated as malformed.
  • Bugfix: in binary compatibility with third-party modules using script codes; the bug had appeared in 1.31.3.
  • Bugfix: in the ngx_http_perl_module.
  • Bugfixes in HTTP/2, HTTP/3, ngx_http_image_filter_module, and ngx_http_grpc_module.