You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2026/10/01 12:55:02 UTC
svn commit: r88140 - dev/httpd release/httpd
Author: covener
Date: Thu Oct 1 12:55:01 2026
New Revision: 88140
Log:
Add release httpd-2.4.69 from voted 2.4.69-rc1
Added:
release/httpd/CHANGES_2.4.69
- copied unchanged from r88139, dev/httpd/CHANGES_2.4.69
release/httpd/httpd-2.4.69.tar.bz2
- copied unchanged from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2
release/httpd/httpd-2.4.69.tar.bz2.asc
- copied unchanged from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.asc
release/httpd/httpd-2.4.69.tar.bz2.sha256
- copied, changed from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha256
release/httpd/httpd-2.4.69.tar.bz2.sha512
- copied, changed from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha512
release/httpd/httpd-2.4.69.tar.gz
- copied unchanged from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz
release/httpd/httpd-2.4.69.tar.gz.asc
- copied unchanged from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.asc
release/httpd/httpd-2.4.69.tar.gz.sha256
- copied, changed from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.sha256
release/httpd/httpd-2.4.69.tar.gz.sha512
- copied, changed from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.sha512
Deleted:
dev/httpd/CHANGES_2.4
dev/httpd/CHANGES_2.4.69
dev/httpd/httpd-2.4.69-rc1-deps.tar.bz2
dev/httpd/httpd-2.4.69-rc1-deps.tar.bz2.asc
dev/httpd/httpd-2.4.69-rc1-deps.tar.bz2.sha256
dev/httpd/httpd-2.4.69-rc1-deps.tar.bz2.sha512
dev/httpd/httpd-2.4.69-rc1-deps.tar.gz
dev/httpd/httpd-2.4.69-rc1-deps.tar.gz.asc
dev/httpd/httpd-2.4.69-rc1-deps.tar.gz.sha256
dev/httpd/httpd-2.4.69-rc1-deps.tar.gz.sha512
dev/httpd/httpd-2.4.69-rc1.tar.bz2
dev/httpd/httpd-2.4.69-rc1.tar.bz2.asc
dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha256
dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha512
dev/httpd/httpd-2.4.69-rc1.tar.gz
dev/httpd/httpd-2.4.69-rc1.tar.gz.asc
dev/httpd/httpd-2.4.69-rc1.tar.gz.sha256
dev/httpd/httpd-2.4.69-rc1.tar.gz.sha512
Modified:
release/httpd/Announcement2.4.html
release/httpd/Announcement2.4.txt
release/httpd/CHANGES_2.4
Modified: release/httpd/Announcement2.4.html
==============================================================================
--- release/httpd/Announcement2.4.html Thu Oct 1 12:08:52 2026 (r88139)
+++ release/httpd/Announcement2.4.html Thu Oct 1 12:55:01 2026 (r88140)
@@ -49,15 +49,15 @@
<div class="banner"></div>
<h1>
- Apache HTTP Server 2.4.68 Released
+ Apache HTTP Server 2.4.69 Released
</h1>
<p>
- June 08, 2026
+ October 01, 2026
</p>
<p>
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to <a href="https://www.apache.org/dist/httpd/Announcement2.4.html">announce</a>
- the release of version 2.4.68 of the Apache
+ the release of version 2.4.69 of the Apache
HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
@@ -69,7 +69,7 @@
encourage users of all prior versions to upgrade.
</p>
<p>
- Apache HTTP Server 2.4.68 is available for download from:
+ Apache HTTP Server 2.4.69 is available for download from:
</p>
<dl>
<dd><a href="https://httpd.apache.org/download.cgi"
@@ -77,7 +77,7 @@
</dl>
<p>
Please see the <a href="./CHANGES_2.4">CHANGES_2.4</a> file, linked from the download page, for a
- full list of changes. A condensed list, <a href="./CHANGES_2.4.68">CHANGES_2.4.68</a> includes only
+ full list of changes. A condensed list, <a href="./CHANGES_2.4.69">CHANGES_2.4.69</a> includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
Modified: release/httpd/Announcement2.4.txt
==============================================================================
--- release/httpd/Announcement2.4.txt Thu Oct 1 12:08:52 2026 (r88139)
+++ release/httpd/Announcement2.4.txt Thu Oct 1 12:55:01 2026 (r88140)
@@ -1,9 +1,9 @@
- Apache HTTP Server 2.4.68 Released
+ Apache HTTP Server 2.4.69 Released
- June 08, 2026
+ October 01, 2026
The Apache Software Foundation and the Apache HTTP Server Project
- are pleased to announce the release of version 2.4.68 of the Apache
+ are pleased to announce the release of version 2.4.69 of the Apache
HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
@@ -13,7 +13,7 @@
We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.
- Apache HTTP Server 2.4.68 is available for download from:
+ Apache HTTP Server 2.4.69 is available for download from:
https://httpd.apache.org/download.cgi
@@ -24,7 +24,7 @@
https://httpd.apache.org/docs/trunk/new_features_2_4.html
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.68 includes only
+ full list of changes. A condensed list, CHANGES_2.4.69 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
Modified: release/httpd/CHANGES_2.4
==============================================================================
--- release/httpd/CHANGES_2.4 Thu Oct 1 12:08:52 2026 (r88139)
+++ release/httpd/CHANGES_2.4 Thu Oct 1 12:55:01 2026 (r88140)
@@ -1,4 +1,51 @@
-*- coding: utf-8 -*-
+Changes with Apache 2.4.69
+
+ *) Fix the tar icon in the documentation so that its background is
+ transparent. PR 70238. [Jeffery To <jeffery.to gmail.com>]
+
+ *) mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore,
+ X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1.
+ PR 70205. [Craig Lorentzen <crlorent amazon.com>]
+
+ *) mod_cgid, mod_ssl, mod_md: Various hardening fixes. [Various authors]
+
+ *) mod_md: MDServerStatus is now disabled by default. [Joe Orton]
+
+ *) mod_auth_digest: Fix compatibility with expression-based AuthName.
+ PR 59039. [Eric Covener]
+
+ *) mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory
+ handling and client nonce handling; "authdigest-opaque" mutex is
+ now longer needed. [Joe Orton]
+
+ *) mod_lbmethod_heartbeat: Use safe integer parsing with range
+ validation, replacing atoi(). [Sayed Kaif <metsw24 gmail.com>]
+
+ *) core: Reject control characters in the reason phrase of interim
+ responses. Only accept space as status-code separator. [Joe Orton]
+
+ *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
+ large for the K/M/G suffix. [Joe Orton]
+
+ *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
+ directive with a missing closing delimiter. [Joe Orton]
+
+ *) mod_dir: Fix a crash in fixup_dir for a request not mapped to any type.
+ PR68527. [Eric Covener]
+
+ *) mod_http2: Do not drop an in-flight response when a client sends a
+ graceful GOAWAY (error code 0) while streams it opened are still
+ being processed. The session now drains open streams instead of
+ tearing down immediately, which async MPMs hit far more than event.
+ Fixes a silently dropped response; RFC 9113 compliant. [Jim Jagielski]
+
+ *) mod_md: OpenSSL 4 compatibility.
+
+ *) pytest_suite: Port of the old PERL test framework to Python
+ and pytest. Now included in the source tree under ./test
+ [Jim Jagielski]
+
Changes with Apache 2.4.68
*) SECURITY: CVE-2026-49975: mod_http2 denial of service
Copied: release/httpd/CHANGES_2.4.69 (from r88139, dev/httpd/CHANGES_2.4.69)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/httpd/CHANGES_2.4.69 Thu Oct 1 12:55:01 2026 (r88140, copy of r88139, dev/httpd/CHANGES_2.4.69)
@@ -0,0 +1,48 @@
+ -*- coding: utf-8 -*-
+Changes with Apache 2.4.69
+
+ *) Fix the tar icon in the documentation so that its background is
+ transparent. PR 70238. [Jeffery To <jeffery.to gmail.com>]
+
+ *) mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore,
+ X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1.
+ PR 70205. [Craig Lorentzen <crlorent amazon.com>]
+
+ *) mod_cgid, mod_ssl, mod_md: Various hardening fixes. [Various authors]
+
+ *) mod_md: MDServerStatus is now disabled by default. [Joe Orton]
+
+ *) mod_auth_digest: Fix compatibility with expression-based AuthName.
+ PR 59039. [Eric Covener]
+
+ *) mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory
+ handling and client nonce handling; "authdigest-opaque" mutex is
+ now longer needed. [Joe Orton]
+
+ *) mod_lbmethod_heartbeat: Use safe integer parsing with range
+ validation, replacing atoi(). [Sayed Kaif <metsw24 gmail.com>]
+
+ *) core: Reject control characters in the reason phrase of interim
+ responses. Only accept space as status-code separator. [Joe Orton]
+
+ *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
+ large for the K/M/G suffix. [Joe Orton]
+
+ *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
+ directive with a missing closing delimiter. [Joe Orton]
+
+ *) mod_dir: Fix a crash in fixup_dir for a request not mapped to any type.
+ PR68527. [Eric Covener]
+
+ *) mod_http2: Do not drop an in-flight response when a client sends a
+ graceful GOAWAY (error code 0) while streams it opened are still
+ being processed. The session now drains open streams instead of
+ tearing down immediately, which async MPMs hit far more than event.
+ Fixes a silently dropped response; RFC 9113 compliant. [Jim Jagielski]
+
+ *) mod_md: OpenSSL 4 compatibility.
+
+ *) pytest_suite: Port of the old PERL test framework to Python
+ and pytest. Now included in the source tree under ./test
+ [Jim Jagielski]
+
Copied: release/httpd/httpd-2.4.69.tar.bz2 (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2)
==============================================================================
Binary file (source and/or target). No diff available.
Copied: release/httpd/httpd-2.4.69.tar.bz2.asc (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/httpd/httpd-2.4.69.tar.bz2.asc Thu Oct 1 12:55:01 2026 (r88140, copy of r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.asc)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAABCgA5FiEEZbLUT+dL1ePeOsPwgngd5G1ZVPoFAmq7srkbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEIJ4HeRtWVT6eVkP/RiBnMr3Z62meFgon0u5
+zBlP1+3xPuc5XeollAPqbiA6NfW+u9yhJz8xgChY97p4JC/JnNNEtTQWcHC4tvAm
+MisoVQPOZMLU2BO1tiZIZ3MU36hIpuFanl0CxXQvLgqm7Rykp0DFgbAP3DKDHf3W
+/EjFXUJoD93McyRAFp4X5t5kGz2V2C9NhmqUp7FKCBasmD8sehrojh8gGlh2ordc
+dcORdEe78AviE0kODxOoWqSHLofcji05ykjFR0kEBTw2ShGm46p5BdLQTYRJ4z+S
+rzL75RnAGqvWL1SrXPc+C0+NyHns7xlVKDqdblViJo+6yj9EvQtpz7l4MuQ6+E5R
+r8eJOS3FmVTo7eGutMfJg9OuWAOxAWl5/PGFQBBohzIJIQAU1kCYgX8lZnG9N/jk
+TQFg6W0oZEQnzC1r9d7GjOXfqy/Sxa2aLP1T0awfahOl6jADYNlF3the1J+V9KWj
+7SCyCWRSUmTXzgiJb5ISJdHzE901UMKom8B/tfC+AMxE9crIrlqUcV87Z0pK5Mev
+x6RBh6f6TV/ANwOtGyL1icHDbEOMuLIs6TdZtFv2xY4e+Em26P11hOGSHbS80tXy
+v9U1dmnWuzTKF3KeD3unmb3DaSpe1ircn0Zzj7igmL9zXDQcqL4ECZOK6suKl/oq
+ROs/KR7LepZnq1wmropLnqQV
+=/cWK
+-----END PGP SIGNATURE-----
Copied and modified: release/httpd/httpd-2.4.69.tar.bz2.sha256 (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha256)
==============================================================================
--- dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha256 Thu Oct 1 12:08:52 2026 (r88139, copy source)
+++ release/httpd/httpd-2.4.69.tar.bz2.sha256 Thu Oct 1 12:55:01 2026 (r88140)
@@ -1 +1 @@
-c5e6ebc66e349b87d7fc6916ae7cc2a808ed348003de134cf9e9d89d3e2cc73d *httpd-2.4.69-rc1.tar.bz2
+c5e6ebc66e349b87d7fc6916ae7cc2a808ed348003de134cf9e9d89d3e2cc73d *httpd-2.4.69.tar.bz2
Copied and modified: release/httpd/httpd-2.4.69.tar.bz2.sha512 (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha512)
==============================================================================
--- dev/httpd/httpd-2.4.69-rc1.tar.bz2.sha512 Thu Oct 1 12:08:52 2026 (r88139, copy source)
+++ release/httpd/httpd-2.4.69.tar.bz2.sha512 Thu Oct 1 12:55:01 2026 (r88140)
@@ -1 +1 @@
-ca9c5808eef7a0d8d88148b0d2d6045b5a0151823f09afc786b283cef9990036a9c7bc53d043e2f67b6ec06db05f655aa961cb875fa7ad0911fa04fdd295bd93 *httpd-2.4.69-rc1.tar.bz2
+ca9c5808eef7a0d8d88148b0d2d6045b5a0151823f09afc786b283cef9990036a9c7bc53d043e2f67b6ec06db05f655aa961cb875fa7ad0911fa04fdd295bd93 *httpd-2.4.69.tar.bz2
Copied: release/httpd/httpd-2.4.69.tar.gz (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz)
==============================================================================
Binary file (source and/or target). No diff available.
Copied: release/httpd/httpd-2.4.69.tar.gz.asc (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.asc)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ release/httpd/httpd-2.4.69.tar.gz.asc Thu Oct 1 12:55:01 2026 (r88140, copy of r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.asc)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAABCgA5FiEEZbLUT+dL1ePeOsPwgngd5G1ZVPoFAmq7srkbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEIJ4HeRtWVT6B7gP/injRSD1D/TeJv1GlegH
+wqNyk97c9mD3cK6lkEtwlitJyXus4FKaLZMD24IuIz/zN/nis5moH2OELRW2lyjV
+vsqbpcojAq8k8q+cVBcoBqkvRCmYhnDeNfgW62FJD4x7GoHskKr6BD+pM25UzfXB
+S3jqXnq5Yub/+oHcC0FaUrY42z/mhC6FhCDWeSQ7HimKYTLLLRZjpDahhUFwh2P9
+6kGg2UrnZNVEqsDdJzjf2aLKwF5PY2dSF9XuX+AETbEujv+gWMUvsqDMJ9TygLMN
+IbwhviaaFKH7XpFi8CkbrlB77u/x1Oe6eA5UrGhH9DNNKfRNJNjxqXZJzAwDEkcR
+GvMFcl370vzn2XtlPup1lACP5VMvAkKtErno0uYHK65Ed+vHS77eXyWN0DUixawH
+aoS4zlGdX5eoUR7/M7ZPE+2HJVqUd42PwUk3Flf/Sw6zd+XUhEdLAAF8Hhj23YOu
+1j3klcMfexJNjdTUDW1maWoGcupSXjeyuFAAfKgtexO9Z8PVesGqT2Mcvdn2q1Ih
+j78YbCDlJOuNzBGKnOxzyo8ehfGRm/B99xHo742HdsQ2xsiutjqQhJeDpUu7wqDk
+unyF4qwUceL56yONeCpdMJO7jrktQ6hx4Vz7amqcRySUdCZR1ibOROD3EFVgUFXo
+F4cgbzUHiuU/G0uvhtKLKuRL
+=vqix
+-----END PGP SIGNATURE-----
Copied and modified: release/httpd/httpd-2.4.69.tar.gz.sha256 (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.sha256)
==============================================================================
--- dev/httpd/httpd-2.4.69-rc1.tar.gz.sha256 Thu Oct 1 12:08:52 2026 (r88139, copy source)
+++ release/httpd/httpd-2.4.69.tar.gz.sha256 Thu Oct 1 12:55:01 2026 (r88140)
@@ -1 +1 @@
-c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb *httpd-2.4.69-rc1.tar.gz
+c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb *httpd-2.4.69.tar.gz
Copied and modified: release/httpd/httpd-2.4.69.tar.gz.sha512 (from r88139, dev/httpd/httpd-2.4.69-rc1.tar.gz.sha512)
==============================================================================
--- dev/httpd/httpd-2.4.69-rc1.tar.gz.sha512 Thu Oct 1 12:08:52 2026 (r88139, copy source)
+++ release/httpd/httpd-2.4.69.tar.gz.sha512 Thu Oct 1 12:55:01 2026 (r88140)
@@ -1 +1 @@
-5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec *httpd-2.4.69-rc1.tar.gz
+5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec *httpd-2.4.69.tar.gz