-*- coding: utf-8 -*-
Changes with Apache 2.4.71

  *) SECURITY: CVE-2026-119618: mod_http2: heap corruption and RCE in
     assign_headers (cve.mitre.org)
     Concurrent Execution using Shared Resource with Improper
     Synchronization vulnerability in Apache HTTP Server's mod_http2
     in assign_headers() can lead to RCE.
     This issue affects Apache HTTP Server: from 2.4.55 through
     2.4.70.
     Affected releases of mod_h2 from GitHub: from 2.0.8 through
     2.0.42.
     Credits: Anthropic's OSS Scanner, as vulnerability
     ANT-2026-MAPKT6MZ

  *) SECURITY: CVE-2026-109163: mod_vhost_alias 1 byte stack buffer
     overwrite (after CVE-2026-63292) (cve.mitre.org)
     Stack-based buffer overflow vulnerability in Apache HTTP
     Server's mod_vhost_alias (after CVE-2026-63292)
     This issue affects Apache HTTP Server: 2.4.69 and 2.4.70.
     Credits: Gustavo Aiello

  *) SECURITY: CVE-2026-106023: mod_md NULL pointer dereference leads
     to child process crash (cve.mitre.org)
     NULL pointer dereference vulnerability in Apache HTTP Server's
     mod_md during HTTP request processing.
     This issue affects Apache HTTP Server: from 2.4.30 through
     2.4.70.
     Credits: hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability
     Research Institute, working with 360 TuLongFeng.

  *) mod_md: MDHttpProxy and MDCACertificateFile can now be set per MDomain.
     New directive MDHttpProxyCACertificateFile sets the CA certificates
     used to verify an HTTPS proxy.
     [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_deflate: Read the gzip extra-field (FEXTRA) length as unsigned so a
     length byte with the high bit set is no longer sign-extended, fixing
     inflation of gzip streams that carry an extra field.
     [arshiya tabasum <arshi bugqore.com>]

  *) mod_remoteip: Apply RemoteIP{Trusted,Internal}ProxyList to the virtual host
     they are configured in, and merge the proxy entries of the main server
     and of the virtual host, logging a warning when both have some.
     PR 70207.  [Arturo Bernal]

  *) mod_dav: Fix handling of invalid or overflowing "Timeout:"
     request headers, which could silently grant a lock with an
     already-expired timeout instead of the RFC 4918 maximum.
     PR 65788 [Arturo Bernal]

  *) mod_http2: Correctly handle the asterisk-form of OPTIONS requests
     instead of rejecting them as malformed.  PR 70195.
     [Arturo Bernal <abernal apache.org>]

  *) mod_http2: Fix duplicate logging of header limit violations.
     [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_http2: Fix a crash creating an HTTP/2 session with
     "H2PushDiarySize 0" and debug logging enabled.  [Joe Orton]

  *) mod_dav_lock: Fix dav_generic_load_lock_record() reading the
     indirect-lock key length with the wrong width, which could read
     back a wrong length on big-endian platforms. PR 70299
     [Arturo Bernal]

  *) mod_remoteip: Log a connection closed before a complete PROXY protocol
     header was received at info level rather than as an error.  PR 63893.
     [Joe Orton]