Topic: Apache httpd 2.4.26 GA available

[Steffen]

Apache httpd 2.4.26 GA is now available at the download pages.

For the ASF and Apachelounge changes https://www.apachelounge.com/Changelog-2.4.html

For security vulnerabilities (CVE) fixed in 2.4.26 see https://httpd.apache.org/security/vulnerabilities_24.html

Notice that mod_brotli is added, more info and configuration see https://www.apachelounge.com/viewtopic.php?p=35265

Build with:
nghttp2 1.23.1
apr 1.6.2
apr-util 1.6.0 with Crypto OpenSSL enabled
apr-iconv 1.2.1
VC15 openssl 1.1.0f, VC11/14 openssl 1.0.2l
zlib 1.2.11
brotli lib 1.0.0
pcre 8.40 with JIT, SUPPORT_UTF8 and REBUILD_CHARTABLES enabled
httpd.exe with OPENSSL_Applink and VC14/15 SupportedOS Manifest
libxml2 2.9.4
lua 5.2.4
expat 2.2.0

VC15 notes:
VC15 is backward compatible to VC14. That means, a VC14 module can be used inside a VC15 binary. Because this compatibility the version number of the Redistributable is 14.1x.xx and after you install, the Redistributable VS2015 is updated from 14.0x.xx to VS2017 14.1x.xx (you can still use VC14).


Documentation: http://httpd.apache.org/docs/2.4/ attention there when you want to Upgrade to 2.4 from 2.2

When you have hangs, slow traffic and/or when having in your log entries like Asynchronous AcceptEx failed. You can try the following settings:

AcceptFilter http none
AcceptFilter https none
EnableSendfile off
EnableMMAP off

Enjoy,

Steffen

------------------------ ASF Announcement ---------------------

The Apache Software Foundation and the Apache HTTP Server Project
are pleased to announce the release of version 2.4.26 of the Apache
HTTP Server ("Apache"). This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
recommended over all previous releases. This release of Apache is
a security, feature, and bug fix release.

We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.

[admin]

Lua version Apache mod_status using dynamic charts, see https://www.apachelounge.com/viewtopic.php?t=7652

[Steffen]

The change log was not clear about the CVE Security vulnerabilities fixed in 2.4.26.

See https://httpd.apache.org/security/vulnerabilities_24.html