Topic: Apache httpd 2.4.56 GA Available

[Steffen]

Apache httpd 2.4.56 is released as GA.

ASF and Apachelounge changes : https://www.apachelounge.com/Changelog-2.4.html

Important security vulnerabilitie is fixed in 2.4.56, see https://httpd.apache.org/security/vulnerabilities_24.html .

Documentation: http://httpd.apache.org/docs/2.4/

Build with dependencies:

- openssl VS16 1.1.1t, VS17 3.0.8
- nghttp2 1.52.0
- jansson 2.14
- curl 7.88.1
- apr 1.7.2
- apr-util 1.6.3
- apr-iconv 1.2.2
- zlib 1.2.13
- brotli 1.0.9
- pcre2 10.42
- libxml2 2.10.3
- lua VS16 5.2.4, VS17 5.4.4
- expat 2.5.0

Notes VS17 OpenSSL 3.0.x:

- Only PHP 8.2 (build with 3.0.x) is running as module.
Running with mod_fcgid no issues seen.

For running as module, See also the post from user Otomatic and notes at https://www.apachelounge.com/viewtopic.php?t=8969
and https://www.apachelounge.com/viewtopic.php?t=8938

- With too weak certificates/ciphers Apache does not start, see https://www.apachelounge.com/viewtopic.php?t=8819


When you have hangs, slow traffic and/or when having in your log entries like Asynchronous AcceptEx failed. You can try the following settings:

AcceptFilter http none
AcceptFilter https none
EnableSendfile off
EnableMMAP off

Enjoy,

Steffen

[Jan-E]

Apache 2.4.57 will probably be put into vote this weekend. It will fix a crash in mod_http2 with mod_fcgid, which is present in 2.4.55 and 2.4.56.

For those of you that run into this: apply https://github.com/apache/httpd/commit/d6a9e4 or (in patch form) https://github.com/apache/httpd/commit/d6a9e4.patch and recompile Apache.

More info:
https://marc.info/?l=apache-httpd-dev&m=168022372218971&w=2

[nono303]

Thx @Jan-E!
I was digging around mod_fcgid crash since few days and was not aware of the fix...
I've applied it, fresh compile and will check if all sounds good now with php 8.2.4 as fcgid on httpd 2.4.56, mod_h2 2.0.13, mod_fcgid 2.3.10 with some fix