!232 backport patches

From: @XWwalker 
Reviewed-by: @zhongxuan2 
Signed-off-by: @zhongxuan2

backport-CVE-2024-36387-mod_http2-early-exit-if-bb-is-null.patch

@@ -0,0 +1,39 @@
+From 62aa64e5aea21dd969db97aded4443c98c0735ac Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:51:42 +0000
+Subject: [PATCH] Merge r1918548 from trunk:
+
+mod_http2: early exit if bb is null
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918557 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/62aa64e5aea21dd969db97aded4443c98c0735ac
+
+---
+ modules/http2/h2_c2.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/modules/http2/h2_c2.c b/modules/http2/h2_c2.c
+index a955200944..c65a521ab8 100644
+--- a/modules/http2/h2_c2.c
++++ b/modules/http2/h2_c2.c
+@@ -370,6 +370,13 @@ static apr_status_t h2_c2_filter_out(ap_filter_t* f, apr_bucket_brigade* bb)
+     h2_conn_ctx_t *conn_ctx = h2_conn_ctx_get(f->c);
+     apr_status_t rv;
+ 
++   if (bb == NULL) {
++#if !AP_MODULE_MAGIC_AT_LEAST(20180720, 1)
++        f->c->data_in_output_filters = 0;
++#endif
++        return APR_SUCCESS;
++    }
++
+     ap_assert(conn_ctx);
+ #if AP_HAS_RESPONSE_BUCKETS
+     if (!conn_ctx->has_final_response) {
+-- 
+2.33.0
+

backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch

@@ -0,0 +1,79 @@
+From 93aec0e3ca451bcc97f6d91c14d5399d13a73365 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 25 Jun 2024 15:28:00 +0000
+Subject: [PATCH] Merge r1918553 from trunk:
+
+block inadvertent subst of special filenames
+
++ cosmetic merge conflicts
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918600 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/93aec0e3ca451bcc97f6d91c14d5399d13a73365
+
+---
+ modules/mappers/mod_rewrite.c | 38 ++++++++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index bbcc11b..a231b7c 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -4280,6 +4280,32 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+         return 2;
+     }
+ 
++    /* Add the previously stripped per-directory location prefix, unless
++     * (1) it's an absolute URL path and
++     * (2) it's a full qualified URL
++     */
++    if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
++        if (ctx->perdir) {
++            rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
++                       newuri, ctx->perdir, newuri));
++
++            newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
++        }
++        else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
++            /* Not an absolute URI-path and the scheme (if any) is unknown,
++             * and it won't be passed to fully_qualify_uri() below either,
++             * so add an implicit '/' prefix. This avoids potentially a common
++             * rule like "RewriteRule ^/some/path(.*) $1" that is given a path
++             * like "/some/pathscheme:..." to produce the fully qualified URL
++             * "scheme:..." which could be misinterpreted later.
++             */
++            rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s",
++                       newuri, newuri));
++
++            newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
++        }
++    }
++
+     /* Now adjust API's knowledge about r->filename and r->args */
+     r->filename = newuri;
+ 
+@@ -4289,18 +4315,6 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ 
+     splitout_queryargs(r, p->flags);
+ 
+-    /* Add the previously stripped per-directory location prefix, unless
+-     * (1) it's an absolute URL path and
+-     * (2) it's a full qualified URL
+-     */
+-    if (   ctx->perdir && !is_proxyreq && *r->filename != '/'
+-        && !is_absolute_uri(r->filename, NULL)) {
+-        rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+-                    r->filename, ctx->perdir, r->filename));
+-
+-        r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL);
+-    }
+-
+     /* If this rule is forced for proxy throughput
+      * (`RewriteRule ... ... [P]') then emulate mod_proxy's
+      * URL-to-filename handler to be sure mod_proxy is triggered
+-- 
+2.33.0
+

backport-CVE-2024-38473-fix-comparsion-of-local-path.patch

@@ -0,0 +1,58 @@
+From cc00cf6b4e37370897daddc307bf1deecf8fedfa Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 25 Jun 2024 20:20:05 +0000
+Subject: [PATCH] Merge r1918623 from trunk:
+
+fix comparison of local path on Windows
+
+Submitted By: Yann Ylavic
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918625 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/cc00cf6b4e37370897daddc307bf1deecf8fedfa
+
+---
+ modules/mappers/mod_rewrite.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index a231b7c..6076cc2 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -642,6 +642,19 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs)
+     return 0;
+ }
+ 
++static int is_absolute_path(const char *path)
++{
++#ifndef WIN32
++    return (path[0] == '/');
++#else
++#define IS_SLASH(c) ((c) == '/' || (c) == '\\')
++    /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */
++    return ((IS_SLASH(path[0]) && path[1] == path[0])
++            || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2])));
++#undef IS_SLASH
++#endif
++}
++
+ static const char c2x_table[] = "0123456789abcdef";
+ 
+ static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix,
+@@ -4284,7 +4297,9 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+      * (1) it's an absolute URL path and
+      * (2) it's a full qualified URL
+      */
+-    if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
++    if (!is_proxyreq
++        && !is_absolute_path(newuri)
++        && !is_absolute_uri(newuri, NULL)) {
+         if (ctx->perdir) {
+             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                        newuri, ctx->perdir, newuri));
+-- 
+2.33.0
+

backport-CVE-2024-38473-fix-the-filename-redirected.patch

@@ -0,0 +1,215 @@
+From 4326d6b9041a3bcb9b529f9163d0761c2d760700 Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Wed, 26 Jun 2024 14:56:47 +0000
+Subject: [PATCH] factor out IS_SLASH, perdir fix
+
+in per-dir, the filename will be internally redirected, so / is OK too.
+
+
+don't add / to / in the non-perdir
+
+
+match AP_IS_SLASH macro
+
+followup to 1918651
+
+
+Merges r1918651, r1918652, r1918663 from trunk
+Reviewed by: covener, ylavic, rpluem
+GH: close #458
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918668 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/4326d6b9041a3bcb9b529f9163d0761c2d760700
+
+---
+ include/ap_mmn.h              |  3 ++-
+ include/httpd.h               | 11 +++++++++++
+ modules/mappers/mod_rewrite.c | 11 ++++-------
+ server/util.c                 | 31 ++++++++++---------------------
+ 4 files changed, 27 insertions(+), 29 deletions(-)
+
+diff --git a/include/ap_mmn.h b/include/ap_mmn.h
+index ad7e3ba..866a26b 100644
+--- a/include/ap_mmn.h
++++ b/include/ap_mmn.h
+@@ -598,6 +598,7 @@
+  * 20120211.128 (2.4.55-dev) Add AP_CTIME_OPTION_GMTOFF to util_time.h
+  * 20120211.129 (2.4.58-dev) Add ap_get_pollfd_from_conn()
+  * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename()
++ * 20120211.134 (2.4.60-dev) AP_SLASHES and AP_IS_SLASH
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+@@ -605,7 +606,7 @@
+ #ifndef MODULE_MAGIC_NUMBER_MAJOR
+ #define MODULE_MAGIC_NUMBER_MAJOR 20120211
+ #endif
+-#define MODULE_MAGIC_NUMBER_MINOR 133                 /* 0...n */
++#define MODULE_MAGIC_NUMBER_MINOR 134                 /* 0...n */
+ 
+ /**
+  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
+diff --git a/include/httpd.h b/include/httpd.h
+index 799cf97..1549be0 100644
+--- a/include/httpd.h
++++ b/include/httpd.h
+@@ -2656,6 +2656,17 @@ AP_DECLARE(const char *)ap_dir_fnmatch(ap_dir_match_t *w, const char *path,
+  */
+ AP_DECLARE(int) ap_is_chunked(apr_pool_t *p, const char *line);
+ 
++/* Win32/NetWare/OS2 need to check for both forward and back slashes
++ * in ap_normalize_path() and ap_escape_url().
++ */
++#ifdef CASE_BLIND_FILESYSTEM
++#define AP_IS_SLASH(s) ((s == '/') || (s == '\\'))
++#define AP_SLASHES "/\\"
++#else
++#define AP_IS_SLASH(s) (s == '/')
++#define AP_SLASHES "/"
++#endif
++
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 6076cc2..92a3f64 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -644,14 +644,11 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs)
+ 
+ static int is_absolute_path(const char *path)
+ {
+-#ifndef WIN32
++#ifndef CASE_BLIND_FILESYSTEM
+     return (path[0] == '/');
+ #else
+-#define IS_SLASH(c) ((c) == '/' || (c) == '\\')
+-    /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */
+-    return ((IS_SLASH(path[0]) && path[1] == path[0])
+-            || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2])));
+-#undef IS_SLASH
++    return ((AP_IS_SLASH(path[0]) && path[1] == path[0])
++            || (apr_isalpha(path[0]) && path[1] == ':' && AP_IS_SLASH(path[2])));
+ #endif
+ }
+ 
+@@ -4299,11 +4296,11 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+      */
+     if (!is_proxyreq
+         && !is_absolute_path(newuri)
++        && !AP_IS_SLASH(*newuri)
+         && !is_absolute_uri(newuri, NULL)) {
+         if (ctx->perdir) {
+             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                        newuri, ctx->perdir, newuri));
+-
+             newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
+         }
+         else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
+diff --git a/server/util.c b/server/util.c
+index 4602c7a..daa2017 100644
+--- a/server/util.c
++++ b/server/util.c
+@@ -75,17 +75,6 @@
+  */
+ #include "test_char.h"
+ 
+-/* Win32/NetWare/OS2 need to check for both forward and back slashes
+- * in ap_normalize_path() and ap_escape_url().
+- */
+-#ifdef CASE_BLIND_FILESYSTEM
+-#define IS_SLASH(s) ((s == '/') || (s == '\\'))
+-#define SLASHES "/\\"
+-#else
+-#define IS_SLASH(s) (s == '/')
+-#define SLASHES "/"
+-#endif
+-
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -492,7 +481,7 @@ AP_DECLARE(apr_status_t) ap_pregsub_ex(apr_pool_t *p, char **result,
+ /* Forward declare */
+ static char x2c(const char *what);
+ 
+-#define IS_SLASH_OR_NUL(s) (s == '\0' || IS_SLASH(s))
++#define IS_SLASH_OR_NUL(s) (s == '\0' || AP_IS_SLASH(s))
+ 
+ /*
+  * Inspired by mod_jk's jk_servlet_normalize().
+@@ -504,7 +493,7 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags)
+     int decode_unreserved = (flags & AP_NORMALIZE_DECODE_UNRESERVED) != 0;
+     int merge_slashes = (flags & AP_NORMALIZE_MERGE_SLASHES) != 0;
+ 
+-    if (!IS_SLASH(path[0])) {
++    if (!AP_IS_SLASH(path[0])) {
+         /* Besides "OPTIONS *", a request-target should start with '/'
+          * per RFC 7230 section 5.3, so anything else is invalid.
+          */
+@@ -545,12 +534,12 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags)
+             }
+         }
+ 
+-        if (w == 0 || IS_SLASH(path[w - 1])) {
++        if (w == 0 || AP_IS_SLASH(path[w - 1])) {
+             /* Collapse ///// sequences to / */
+-            if (merge_slashes && IS_SLASH(path[l])) {
++            if (merge_slashes && AP_IS_SLASH(path[l])) {
+                 do {
+                     l++;
+-                } while (IS_SLASH(path[l]));
++                } while (AP_IS_SLASH(path[l]));
+                 continue;
+             }
+ 
+@@ -579,7 +568,7 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags)
+                     if (w > 1) {
+                         do {
+                             w--;
+-                        } while (w && !IS_SLASH(path[w - 1]));
++                        } while (w && !AP_IS_SLASH(path[w - 1]));
+                     }
+                     else {
+                         /* Already at root, ignore and return a failure
+@@ -1915,7 +1904,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved,
+                 char decoded;
+                 decoded = x2c(y + 1);
+                 if ((decoded == '\0')
+-                    || (forbid_slashes && IS_SLASH(decoded))
++                    || (forbid_slashes && AP_IS_SLASH(decoded))
+                     || (forbid && ap_strchr_c(forbid, decoded))) {
+                     badpath = 1;
+                     *x = decoded;
+@@ -1923,7 +1912,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved,
+                 }
+                 else if ((keep_unreserved && TEST_CHAR(decoded,
+                                                        T_URI_UNRESERVED))
+-                         || (keep_slashes && IS_SLASH(decoded))
++                         || (keep_slashes && AP_IS_SLASH(decoded))
+                          || (reserved && ap_strchr_c(reserved, decoded))) {
+                     *x++ = *y++;
+                     *x++ = *y++;
+@@ -1950,7 +1939,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved,
+ AP_DECLARE(int) ap_unescape_url(char *url)
+ {
+     /* Traditional */
+-    return unescape_url(url, SLASHES, NULL, 0);
++    return unescape_url(url, AP_SLASHES, NULL, 0);
+ }
+ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes)
+ {
+@@ -1960,7 +1949,7 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes)
+         return unescape_url(url, NULL, NULL, 0);
+     } else {
+         /* reserve (do not decode) encoded slashes */
+-        return unescape_url(url, NULL, SLASHES, 0);
++        return unescape_url(url, NULL, AP_SLASHES, 0);
+     }
+ }
+ AP_DECLARE(int) ap_unescape_url_ex(char *url, unsigned int flags)
+-- 
+2.33.0
+

backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch

@@ -0,0 +1,236 @@
+From 6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Wed, 26 Jun 2024 14:51:32 +0000
+Subject: [PATCH] mod_proxy: Fixup UDS filename for mod_proxy called through
+ r->handler.
+
+* modules/proxy/proxy_util.c:
+  Export ap_proxy_fixup_uds_filename() from fix_uds_filename.
+  Call it from ap_proxy_pre_request() even for rewritten balancer workers.
+
+* modules/proxy/mod_proxy.h:
+  Declare ap_proxy_fixup_uds_filename()
+
+* modules/proxy/mod_proxy.c:
+  Fixup UDS filename from r->handler in proxy_handler().
+
+* include/ap_mmn.h:
+  Bump MMN minor for ap_proxy_fixup_uds_filename()
+
+
+mod_proxy: follow up to r1918626: Simplify ap_proxy_fixup_uds_filename() and callers.
+
+
+Merges r1918626, r1918647 from trunk
+GH: closes #457
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918666 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:Version adaptation exists in ap_mmn.h
+Reference:https://github.com/apache/httpd/commit/6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce
+
+---
+ include/ap_mmn.h           |  3 ++-
+ modules/proxy/mod_proxy.c  | 33 ++++++++++++++++++------------
+ modules/proxy/mod_proxy.h  |  8 ++++++++
+ modules/proxy/proxy_util.c | 41 ++++++++++++++++++++++----------------
+ 4 files changed, 54 insertions(+), 31 deletions(-)
+
+diff --git a/include/ap_mmn.h b/include/ap_mmn.h
+index e008a48..ad7e3ba 100644
+--- a/include/ap_mmn.h
++++ b/include/ap_mmn.h
+@@ -597,6 +597,7 @@
+  * 20120211.127 (2.4.56-dev) Add ap_proxy_canonenc_ex
+  * 20120211.128 (2.4.55-dev) Add AP_CTIME_OPTION_GMTOFF to util_time.h
+  * 20120211.129 (2.4.58-dev) Add ap_get_pollfd_from_conn()
++ * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename()
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+@@ -604,7 +605,7 @@
+ #ifndef MODULE_MAGIC_NUMBER_MAJOR
+ #define MODULE_MAGIC_NUMBER_MAJOR 20120211
+ #endif
+-#define MODULE_MAGIC_NUMBER_MINOR 129                 /* 0...n */
++#define MODULE_MAGIC_NUMBER_MINOR 133                 /* 0...n */
+ 
+ /**
+  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
+diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
+index 34c1ceb..ee5b828 100644
+--- a/modules/proxy/mod_proxy.c
++++ b/modules/proxy/mod_proxy.c
+@@ -1227,6 +1227,7 @@ static int proxy_fixup(request_rec *r)
+ 
+     return OK;      /* otherwise; we've done the best we can */
+ }
++
+ /* Send a redirection if the request contains a hostname which is not */
+ /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */
+ /* servers like Netscape's allow this and access hosts from the local */
+@@ -1280,7 +1281,7 @@ static int proxy_handler(request_rec *r)
+         ap_get_module_config(sconf, &proxy_module);
+     apr_array_header_t *proxies = conf->proxies;
+     struct proxy_remote *ents = (struct proxy_remote *) proxies->elts;
+-    int i, rc, access_status;
++    int rc = DECLINED, access_status, i;
+     int direct_connect = 0;
+     const char *str;
+     apr_int64_t maxfwd;
+@@ -1295,22 +1296,28 @@ static int proxy_handler(request_rec *r)
+         return DECLINED;
+     }
+ 
+-    if (!r->proxyreq) {
+-        rc = DECLINED;
+-        /* We may have forced the proxy handler via config or .htaccess */
+-        if (r->handler &&
+-            strncmp(r->handler, "proxy:", 6) == 0 &&
+-            strncmp(r->filename, "proxy:", 6) != 0) {
+-            r->proxyreq = PROXYREQ_REVERSE;
+-            r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
+-            /* Still need to fixup/canonicalize r->filename */
++    /* We may have forced the proxy handler via config or .htaccess */
++    if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) {
++        char *old_filename = r->filename;
++
++        r->proxyreq = PROXYREQ_REVERSE;
++        r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
++
++        /* Still need to fixup/canonicalize r->filename */
++        rc = ap_proxy_fixup_uds_filename(r);
++        if (rc <= OK) {
+             rc = proxy_fixup(r);
+         }
+         if (rc != OK) {
+-            return rc;
++            r->filename = old_filename;
++            r->proxyreq = 0;
+         }
+-    } else if (strncmp(r->filename, "proxy:", 6) != 0) {
+-        return DECLINED;
++    }
++    else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) {
++        rc = OK;
++    }
++    if (rc != OK) {
++        return rc;
+     }
+ 
+     /* handle max-forwards / OPTIONS / TRACE */
+diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
+index c51145e..868a1e9 100644
+--- a/modules/proxy/mod_proxy.h
++++ b/modules/proxy/mod_proxy.h
+@@ -993,6 +993,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov
+                                                                  proxy_balancer *balancer,
+                                                                  unsigned int *index);
+ 
++/*
++ * Strip the UDS part of r->filename if any, and put the UDS path in
++ * r->notes ("uds_path")
++ * @param r        current request
++ * @return         OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error
++ */
++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r);
++
+ /**
+  * Get the most suitable worker and/or balancer for the request
+  * @param worker   worker used for processing request
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 0500570..541e944 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -2316,7 +2316,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke
+  * were passed a UDS url (eg: from mod_proxy) and adjust uds_path
+  * as required.  
+  */
+-static int fix_uds_filename(request_rec *r, char **url) 
++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) 
+ {
+     char *uds_url = r->filename + 6, *origin_url;
+ 
+@@ -2324,7 +2324,6 @@ static int fix_uds_filename(request_rec *r, char **url)
+             !ap_cstr_casecmpn(uds_url, "unix:", 5) &&
+             (origin_url = ap_strchr(uds_url + 5, '|'))) {
+         char *uds_path = NULL;
+-        apr_size_t url_len;
+         apr_uri_t urisock;
+         apr_status_t rv;
+ 
+@@ -2339,20 +2338,20 @@ static int fix_uds_filename(request_rec *r, char **url)
+         if (!uds_path) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292)
+                     "Invalid proxy UDS filename (%s)", r->filename);
+-            return 0;
++            return HTTP_BAD_REQUEST;
+         }
+         apr_table_setn(r->notes, "uds_path", uds_path);
+ 
+-        /* Remove the UDS path from *url and r->filename */
+-        url_len = strlen(origin_url);
+-        *url = apr_pstrmemdup(r->pool, origin_url, url_len);
+-        memcpy(uds_url, *url, url_len + 1);
+-
+         ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
+-                "*: rewrite of url due to UDS(%s): %s (%s)",
+-                uds_path, *url, r->filename);
++                "*: fixup UDS from %s: %s (%s)",
++                r->filename, origin_url, uds_path);
++
++        /* Overwrite the UDS part in place */
++        memmove(uds_url, origin_url, strlen(origin_url) + 1);
++        return OK;
+     }
+-    return 1;
++
++    return DECLINED;
+ }
+ 
+ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+@@ -2371,9 +2370,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
+                           "%s: found worker %s for %s",
+                           (*worker)->s->scheme, (*worker)->s->name_ex, *url);
+-            if (!forward && !fix_uds_filename(r, url)) {
+-                return HTTP_INTERNAL_SERVER_ERROR;
+-            }
+             access_status = OK;
+         }
+         else if (forward) {
+@@ -2403,9 +2399,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+                  * regarding the Connection header in the request.
+                  */
+                 apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1");
+-                if (!fix_uds_filename(r, url)) {
+-                    return HTTP_INTERNAL_SERVER_ERROR;
+-                }
+             }
+         }
+     }
+@@ -2415,6 +2408,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+                       "all workers are busy.  Unable to serve %s", *url);
+         access_status = HTTP_SERVICE_UNAVAILABLE;
+     }
++
++    if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) {
++        int rc = ap_proxy_fixup_uds_filename(r);
++        if (ap_is_HTTP_ERROR(rc)) {
++            return rc;
++        }
++        /* If the URL has changed in r->filename, take everything after
++         * the "proxy:" prefix.
++         */
++        if (rc == OK) {
++            *url = apr_pstrdup(r->pool, r->filename + 6);
++        }
++    }
++
+     return access_status;
+ }
+ 
+-- 
+2.33.0
+

backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch

@@ -0,0 +1,44 @@
+From b10cb2d69184843832d501a615abe3e8e5e256dc Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:52:31 +0000
+Subject: [PATCH] Merge r1918550 from trunk:
+
+mod_proxy: escape for non-proxypass configuration
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918559 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/b10cb2d69184843832d501a615abe3e8e5e256dc
+
+---
+ modules/proxy/mod_proxy.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
+index 537c3c2..34c1ceb 100644
+--- a/modules/proxy/mod_proxy.c
++++ b/modules/proxy/mod_proxy.c
+@@ -1296,15 +1296,18 @@ static int proxy_handler(request_rec *r)
+     }
+ 
+     if (!r->proxyreq) {
++        rc = DECLINED;
+         /* We may have forced the proxy handler via config or .htaccess */
+         if (r->handler &&
+             strncmp(r->handler, "proxy:", 6) == 0 &&
+             strncmp(r->filename, "proxy:", 6) != 0) {
+             r->proxyreq = PROXYREQ_REVERSE;
+             r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
++            /* Still need to fixup/canonicalize r->filename */
++            rc = proxy_fixup(r);
+         }
+-        else {
+-            return DECLINED;
++        if (rc != OK) {
++            return rc;
+         }
+     } else if (strncmp(r->filename, "proxy:", 6) != 0) {
+         return DECLINED;
+-- 
+2.33.0
+

backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch

@@ -0,0 +1,405 @@
+From 1feb5e04a4f7b5f3f13cd40f9635144319dcf24a Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:58:17 +0000
+Subject: [PATCH] Merge r1918552 from trunk:
+
+tighten up prefix_stat and %3f handling
+
+Require opt-ins for unsafe substitutions
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918561 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:The XML file does not exist. Therefore, the file is not modified.
+Reference:https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a
+
+---
+ modules/mappers/mod_rewrite.c | 151 +++++++++++++++++++++++++++-------
+ 1 file changed, 123 insertions(+), 28 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 92a3f64..024808b 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -177,6 +177,8 @@ static const char* really_last_key = "rewrite_really_last";
+ #define RULEFLAG_QSLAST             (1<<19)
+ #define RULEFLAG_QSNONE             (1<<20) /* programattic only */
+ #define RULEFLAG_ESCAPECTLS         (1<<21)
++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22)
++#define RULEFLAG_UNSAFE_ALLOW3F     (1<<23)
+ 
+ /* return code of the rewrite rule
+  * the result may be escaped - or not
+@@ -184,7 +186,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define ACTION_NORMAL               (1<<0)
+ #define ACTION_NOESCAPE             (1<<1)
+ #define ACTION_STATUS               (1<<2)
+-
++#define ACTION_STATUS_SET           (1<<3)
+ 
+ #define MAPTYPE_TXT                 (1<<0)
+ #define MAPTYPE_DBM                 (1<<1)
+@@ -208,6 +210,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define OPTION_IGNORE_INHERIT       (1<<8)
+ #define OPTION_IGNORE_CONTEXT_INFO  (1<<9)
+ #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10)
++#define OPTION_UNSAFE_PREFIX_STAT   (1<<12)
+ 
+ #ifndef RAND_MAX
+ #define RAND_MAX 32767
+@@ -301,6 +304,14 @@ typedef enum {
+     CONDPAT_AP_EXPR
+ } pattern_type;
+ 
++typedef enum {
++  RULE_RC_NOMATCH = 0,      /* the rule didn't match                        */
++  RULE_RC_MATCH = 1,        /* a matching rule w/ substitution              */
++  RULE_RC_NOSUB = 2,        /* a matching rule w/ no substitution           */
++  RULE_RC_STATUS_SET = 3    /* a matching rule that has set an HTTP error
++                               to be returned in r->status */
++} rule_return_type;
++
+ typedef struct {
+     char           *input;   /* Input string of RewriteCond   */
+     char           *pattern; /* the RegExp pattern string     */
+@@ -937,10 +948,15 @@ static void fully_qualify_uri(request_rec *r)
+     return;
+ }
+ 
++static int startsWith(request_rec *r, const char *haystack, const char *needle) {
++    int rc = (ap_strstr_c(haystack, needle) == haystack);
++    rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc));
++    return rc;
++}
+ /*
+- * stat() only the first segment of a path
++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule
+  */
+-static int prefix_stat(const char *path, apr_pool_t *pool)
++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub)
+ {
+     const char *curpath = path;
+     const char *root;
+@@ -974,10 +990,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool)
+         apr_finfo_t sb;
+ 
+         if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) {
+-            return 1;
++            if (!lastsub) {
++                rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath));
++                return 1;
++            }
++
++            rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ",
++                    statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT));
++            if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) {
++                return 1;
++            }
++            else {
++                const char *docroot = ap_document_root(r);
++                const char *context_docroot = ap_context_document_root(r);
++                /*
++                 * As an example, path (r->filename) is /var/foo/bar/baz.html
++                 * even if the flag is not set,  we can accept a rule that
++                 * began with a literal /var (stapath), or if the entire path
++                 * starts with the docroot or context document root
++                 */
++                if (startsWith(r, lastsub->output, statpath) ||
++                        startsWith(r, path, docroot) ||
++                        ((docroot != context_docroot) &&
++                          startsWith(r, path, context_docroot))) {
++                    return 1;
++                }
++            }
+         }
+     }
+ 
++    /* prefix will be added */
+     return 0;
+ }
+ 
+@@ -3082,6 +3124,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd,
+         else if (!strcasecmp(w, "legacyprefixdocroot")) {
+             options |= OPTION_LEGACY_PREFIX_DOCROOT;
+         }
++        else if (!strcasecmp(w, "UnsafePrefixStat")) {
++            options |= OPTION_UNSAFE_PREFIX_STAT;
++        }
+         else {
+             return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
+                                w, "'", NULL);
+@@ -3790,6 +3835,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
+             ++error;
+         }
+         break;
++    case 'u':
++    case 'U':
++        if (!strcasecmp(key, "nsafePrefixStat")){
++            cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT);
++        }
++        else if(!strcasecmp(key, "nsafeAllow3F")) {
++            cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F;
++        }
++        else {
++            ++error;
++        }
++        break;
+     default:
+         ++error;
+         break;
+@@ -4148,7 +4205,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+ /*
+  * Apply a single RewriteRule
+  */
+-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
++static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
++                                           rewrite_ctx *ctx)
+ {
+     ap_regmatch_t regmatch[AP_MAX_REG_MATCH];
+     apr_array_header_t *rewriteconds;
+@@ -4199,7 +4257,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+     rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0);
+     if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||
+            (!rc &&  (p->flags & RULEFLAG_NOTMATCH))   ) ) {
+-        return 0;
++        return RULE_RC_NOMATCH;
+     }
+ 
+     /* It matched, wow! Now it's time to prepare the context structure for
+@@ -4250,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+             }
+         }
+         else if (!rc) {
+-            return 0;
++            return RULE_RC_NOMATCH;
+         }
+ 
+         /* If some HTTP header was involved in the condition, remember it
+@@ -4270,6 +4328,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+         newuri = do_expand(p->output, ctx, p);
+         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+                     newuri));
++        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
++            ap_strcasestr(r->unparsed_uri, "%3f") &&
++            ap_strchr_c(newuri, '?')) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
++                    "Unsafe URL with %%3f URL rewritten without "
++                    "UnsafeAllow3F");
++            r->status = HTTP_FORBIDDEN;
++            return RULE_RC_STATUS_SET;
++        }
+     }
+ 
+     /* expand [E=var:val] and [CO=<cookie>] */
+@@ -4287,7 +4354,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+             r->status = p->forced_responsecode;
+         }
+ 
+-        return 2;
++        return RULE_RC_NOSUB;
+     }
+ 
+     /* Add the previously stripped per-directory location prefix, unless
+@@ -4355,7 +4422,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     r->filename));
+ 
+         r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL);
+-        return 1;
++        return RULE_RC_MATCH;
+     }
+ 
+     /* If this rule is explicitly forced for HTTP redirection
+@@ -4370,7 +4437,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     r->filename));
+ 
+         r->status = p->forced_responsecode;
+-        return 1;
++        return RULE_RC_MATCH;
+     }
+ 
+     /* Special Rewriting Feature: Self-Reduction
+@@ -4392,7 +4459,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     "with %s", p->forced_responsecode, r->filename));
+ 
+         r->status = p->forced_responsecode;
+-        return 1;
++        return RULE_RC_MATCH;
+     }
+ 
+     /* Finally remember the forced mime-type */
+@@ -4401,7 +4468,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+     /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_)
+      * But now we're done for this particular rule.
+      */
+-    return 1;
++    return RULE_RC_MATCH;
+ }
+ 
+ /*
+@@ -4409,13 +4476,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+  * i.e. a list of rewrite rules
+  */
+ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+-                              char *perdir)
++                              char *perdir, rewriterule_entry **lastsub)
+ {
+     rewriterule_entry *entries;
+     rewriterule_entry *p;
+     int i;
+     int changed;
+-    int rc;
++    rule_return_type rc;
+     int s;
+     rewrite_ctx *ctx;
+     int round = 1;
+@@ -4423,6 +4490,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+     ctx = apr_palloc(r->pool, sizeof(*ctx));
+     ctx->perdir = perdir;
+     ctx->r = r;
++    *lastsub = NULL;
+ 
+     /*
+      *  Iterate over all existing rules
+@@ -4450,7 +4518,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+         ctx->vary = NULL;
+         rc = apply_rewrite_rule(p, ctx);
+ 
+-        if (rc) {
++        if (rc != RULE_RC_NOMATCH) {
++
++            if (!(p->flags & RULEFLAG_NOSUB)) {
++                rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output));
++                *lastsub = p;
++            }
+ 
+             /* Catch looping rules with pathinfo growing unbounded */
+             if ( strlen( r->filename ) > 2*r->server->limit_req_line ) {
+@@ -4470,6 +4543,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+                 apr_table_merge(r->headers_out, "Vary", ctx->vary);
+             }
+ 
++
++            /* Error while evaluating rule, r->status set */
++            if (RULE_RC_STATUS_SET == rc) {
++                return ACTION_STATUS_SET;
++            }
++
+             /*
+              * The rule sets the response code (implies match-only)
+              */
+@@ -4480,7 +4559,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+             /*
+              * Indicate a change if this was not a match-only rule.
+              */
+-            if (rc != 2) {
++            if (rc != RULE_RC_NOSUB) {
+                 changed = ((p->flags & RULEFLAG_NOESCAPE)
+                            ? ACTION_NOESCAPE : ACTION_NORMAL);
+             }
+@@ -4669,6 +4748,7 @@ static int hook_uri2file(request_rec *r)
+     int rulestatus;
+     void *skipdata;
+     const char *oargs;
++    rewriterule_entry *lastsub = NULL;
+ 
+     /*
+      *  retrieve the config structures
+@@ -4780,7 +4860,7 @@ static int hook_uri2file(request_rec *r)
+         /*
+          *  now apply the rules ...
+          */
+-        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL);
++        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub);
+         apr_table_setn(r->notes, "mod_rewrite_rewritten",
+                        apr_psprintf(r->pool,"%d",rulestatus));
+     }
+@@ -4811,6 +4891,9 @@ static int hook_uri2file(request_rec *r)
+                           "characters or spaces");
+             return HTTP_FORBIDDEN;
+         }
++        else if (ACTION_STATUS_SET == rulestatus) {
++            return r->status;
++        }
+ 
+         if (ACTION_STATUS == rulestatus) {
+             int n = r->status;
+@@ -4937,23 +5020,29 @@ static int hook_uri2file(request_rec *r)
+                 return HTTP_BAD_REQUEST;
+             }
+ 
+-            /* if there is no valid prefix, we call
+-             * the translator from the core and
+-             * prefix the filename with document_root
++            /* We have r->filename as a path in a server-context rewrite without
++             * the PT flag. The historical behavior is to treat it as a verbatim
++             * filesystem path iff the first component of the path exists and is
++             * readable by httpd. Otherwise, it is interpreted as DocumentRoot
++             * relative.
+              *
+              * NOTICE:
+              * We cannot leave out the prefix_stat because
+-             * - when we always prefix with document_root
+-             *   then no absolute path can be created, e.g. via
+-             *   emulating a ScriptAlias directive, etc.
+-             * - when we always NOT prefix with document_root
++             * - If we always prefix with document_root
++             *   then no absolute path can could ever be used in
++             *   a substitution. e.g. emulating an Alias.
++             * - If we never prefix with document_root
+              *   then the files under document_root have to
+              *   be references directly and document_root
+              *   gets never used and will be a dummy parameter -
+-             *   this is also bad
++             *   this is also bad.
++             *   - Later addition: This part is questionable.
++             *     If we had never prefixed, users would just 
++             *     need %{DOCUMENT_ROOT} in substitutions or the 
++             *     [PT] flag.
+              *
+              * BUT:
+-             * Under real Unix systems this is no problem,
++             * Under real Unix systems this is no perf problem,
+              * because we only do stat() on the first directory
+              * and this gets cached by the kernel for along time!
+              */
+@@ -4962,7 +5051,9 @@ static int hook_uri2file(request_rec *r)
+                 uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced");
+             }
+ 
+-            if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) {
++            if (!prefix_stat(r, r->filename, r->pool,
++                             conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub)
++                || uri_reduced != NULL) {
+                 int res;
+                 char *tmp = r->uri;
+ 
+@@ -5007,6 +5098,7 @@ static int hook_fixup(request_rec *r)
+     char *ofilename, *oargs;
+     int is_proxyreq;
+     void *skipdata;
++    rewriterule_entry *lastsub;
+ 
+     dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config,
+                                                         &rewrite_module);
+@@ -5091,7 +5183,7 @@ static int hook_fixup(request_rec *r)
+     /*
+      *  now apply the rules ...
+      */
+-    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
++    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub);
+     if (rulestatus) {
+         unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
+         int to_proxyreq = 0;
+@@ -5113,6 +5205,9 @@ static int hook_fixup(request_rec *r)
+                           "characters or spaces");
+             return HTTP_FORBIDDEN;
+         }
++        else if (ACTION_STATUS_SET == rulestatus) {
++            return r->status;
++        }
+ 
+         if (ACTION_STATUS == rulestatus) {
+             int n = r->status;
+-- 
+2.33.0
+

backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch

@@ -0,0 +1,310 @@
+From 554554b0ebb14d6578adb70a389c57a0d5f18a3b Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:54:34 +0000
+Subject: [PATCH] Merge r1918551 from trunk:
+
+add ap_set_content_type_ex to differentiate
+
+trusted sources
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918560 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/554554b0ebb14d6578adb70a389c57a0d5f18a3b
+
+---
+ include/http_protocol.h           | 11 +++++++++++
+ include/httpd.h                   |  7 +++++++
+ modules/http/http_protocol.c      |  6 ++++++
+ modules/http/mod_mime.c           | 20 ++++++++++----------
+ modules/mappers/mod_actions.c     |  6 ++++--
+ modules/mappers/mod_negotiation.c |  8 ++++----
+ modules/mappers/mod_rewrite.c     |  2 +-
+ modules/metadata/mod_headers.c    |  6 +++---
+ modules/metadata/mod_mime_magic.c |  4 ++--
+ server/config.c                   |  2 +-
+ server/core.c                     |  2 +-
+ 11 files changed, 50 insertions(+), 24 deletions(-)
+
+diff --git a/include/http_protocol.h b/include/http_protocol.h
+index 94c481e..f2c99c9 100644
+--- a/include/http_protocol.h
++++ b/include/http_protocol.h
+@@ -438,6 +438,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l);
+  */
+ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct);
+ 
++/**
++ * Set the content type for this request (r->content_type).
++ * @param r The current request
++ * @param ct The new content type
++ * @param trusted If non-zero, The content-type should come from a
++ *        trusted source such as server configuration rather
++ *        than application output.
++ * for the AddOutputFilterByType directive to work correctly.
++ */
++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted);
++
+ /**
+  * Set the Accept-Ranges header for this response
+  * @param r The current request
+diff --git a/include/httpd.h b/include/httpd.h
+index 1549be0..61e02a9 100644
+--- a/include/httpd.h
++++ b/include/httpd.h
+@@ -667,6 +667,7 @@ typedef apr_uint64_t ap_request_bnotes_t;
+  *
+  */
+ #define AP_REQUEST_STRONG_ETAG 1 >> 0
++#define AP_REQUEST_TRUSTED_CT  1 << 1
+ 
+ /**
+  * This is a convenience macro to ease with getting specific request
+@@ -689,6 +690,12 @@ typedef apr_uint64_t ap_request_bnotes_t;
+         AP_REQUEST_GET_BNOTE((r), AP_REQUEST_STRONG_ETAG)
+ /** @} */
+ 
++/**
++ * Returns true if the content-type field is from a trusted source
++ */
++#define AP_REQUEST_IS_TRUSTED_CT(r) \
++    (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT))
++/** @} */
+ 
+ /**
+  * @defgroup module_magic Module Magic mime types
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index d031f24..c31e873 100644
+--- a/modules/http/http_protocol.c
++++ b/modules/http/http_protocol.c
+@@ -1097,8 +1097,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct)
+     }
+     else if (!r->content_type || strcmp(r->content_type, ct)) {
+         r->content_type = ct;
++        AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0);
+     }
+ }
++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted)
++{
++    ap_set_content_type(r, ct);
++    AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0);
++}
+ 
+ AP_DECLARE(void) ap_set_accept_ranges(request_rec *r)
+ {
+diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c
+index 700f824..51095a0 100644
+--- a/modules/http/mod_mime.c
++++ b/modules/http/mod_mime.c
+@@ -759,7 +759,7 @@ static int find_ct(request_rec *r)
+     int found_metadata = 0;
+ 
+     if (r->finfo.filetype == APR_DIR) {
+-        ap_set_content_type(r, DIR_MAGIC_TYPE);
++        ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1);
+         return OK;
+     }
+ 
+@@ -850,7 +850,7 @@ static int find_ct(request_rec *r)
+         if (exinfo == NULL || !exinfo->forced_type) {
+             if ((type = apr_hash_get(mime_type_extensions, ext,
+                                      APR_HASH_KEY_STRING)) != NULL) {
+-                ap_set_content_type(r, (char*) type);
++                ap_set_content_type_ex(r, (char*) type, 1);
+                 found = 1;
+             }
+         }
+@@ -859,7 +859,7 @@ static int find_ct(request_rec *r)
+ 
+             /* empty string is treated as special case for RemoveType */
+             if (exinfo->forced_type && *exinfo->forced_type) {
+-                ap_set_content_type(r, exinfo->forced_type);
++                ap_set_content_type_ex(r, exinfo->forced_type, 1);
+                 found = 1;
+             }
+ 
+@@ -964,33 +964,33 @@ static int find_ct(request_rec *r)
+             memcpy(tmp, ctp->subtype, ctp->subtype_len);
+             tmp += ctp->subtype_len;
+             *tmp = 0;
+-            ap_set_content_type(r, base_content_type);
++            ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+             while (pp != NULL) {
+                 if (charset && !strcmp(pp->attr, "charset")) {
+                     if (!override) {
+-                        ap_set_content_type(r,
++                        ap_set_content_type_ex(r,
+                                             apr_pstrcat(r->pool,
+                                                         r->content_type,
+                                                         "; charset=",
+                                                         charset,
+-                                                        NULL));
++                                                        NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+                         override = 1;
+                     }
+                 }
+                 else {
+-                    ap_set_content_type(r,
++                    ap_set_content_type_ex(r,
+                                         apr_pstrcat(r->pool,
+                                                     r->content_type,
+                                                     "; ", pp->attr,
+                                                     "=", pp->val,
+-                                                    NULL));
++                                                    NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+                 }
+                 pp = pp->next;
+             }
+             if (charset && !override) {
+-                ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type,
++                ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type,
+                                                    "; charset=", charset,
+-                                                   NULL));
++                                                   NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+             }
+         }
+     }
+diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c
+index ac9c3b7..5e398b5 100644
+--- a/modules/mappers/mod_actions.c
++++ b/modules/mappers/mod_actions.c
+@@ -182,8 +182,10 @@ static int action_handler(request_rec *r)
+         return DECLINED;
+ 
+     /* Second, check for actions (which override the method scripts) */
+-    action = r->handler ? r->handler :
+-        ap_field_noparam(r->pool, r->content_type);
++    action = r->handler;
++    if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) {
++        action = ap_field_noparam(r->pool, r->content_type);
++    }
+ 
+     if (action && (t = apr_table_get(conf->action_types, action))) {
+         int virtual = (*t++ == '0' ? 0 : 1);
+diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c
+index c056b28..a528f81 100644
+--- a/modules/mappers/mod_negotiation.c
++++ b/modules/mappers/mod_negotiation.c
+@@ -1167,7 +1167,7 @@ static int read_types_multi(negotiation_state *neg)
+          * might be doing.
+          */
+         if (sub_req->handler && !sub_req->content_type) {
+-            ap_set_content_type(sub_req, CGI_MAGIC_TYPE);
++            ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1);
+         }
+ 
+         /*
+@@ -3003,14 +3003,14 @@ static int handle_map_file(request_rec *r)
+         /* set MIME type and charset as negotiated */
+         if (best->mime_type && *best->mime_type) {
+             if (best->content_charset && *best->content_charset) {
+-                ap_set_content_type(r, apr_pstrcat(r->pool,
++                ap_set_content_type_ex(r, apr_pstrcat(r->pool,
+                                                    best->mime_type,
+                                                    "; charset=",
+                                                    best->content_charset,
+-                                                   NULL));
++                                                   NULL), 1);
+             }
+             else {
+-                ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type));
++                ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1);
+             }
+         }
+ 
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 024808b..78847f9 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -5454,7 +5454,7 @@ static int hook_mimetype(request_rec *r)
+         rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'",
+                     r->filename, t));
+ 
+-        ap_set_content_type(r, t);
++        ap_set_content_type_ex(r, t, 1);
+     }
+ 
+     /* handler */
+diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c
+index ef812cd..4838bd6 100644
+--- a/modules/metadata/mod_headers.c
++++ b/modules/metadata/mod_headers.c
+@@ -783,14 +783,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+             break;
+         case hdr_set:
+             if (!ap_cstr_casecmp(hdr->header, "Content-Type")) {
+-                 ap_set_content_type(r, process_tags(hdr, r));
++                 ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+             }
+             apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+             break;
+         case hdr_setifempty:
+             if (NULL == apr_table_get(headers, hdr->header)) {
+                 if (!ap_cstr_casecmp(hdr->header, "Content-Type")) {
+-                    ap_set_content_type(r, process_tags(hdr, r));
++                    ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+                 }
+                 apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+             }
+@@ -809,7 +809,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+                 const char *repl = process_regexp(hdr, r->content_type, r);
+                 if (repl == NULL)
+                     return 0;
+-                ap_set_content_type(r, repl);
++                ap_set_content_type_ex(r, repl, 1);
+             }
+             if (apr_table_get(headers, hdr->header)) {
+                 edit_do ed;
+diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c
+index 7dac4fd..1c96db4 100644
+--- a/modules/metadata/mod_mime_magic.c
++++ b/modules/metadata/mod_mime_magic.c
+@@ -788,7 +788,7 @@ static int magic_rsl_to_request(request_rec *r)
+     /* XXX: this could be done at config time I'm sure... but I'm
+      * confused by all this magic_rsl stuff. -djg */
+     ap_content_type_tolower(tmp);
+-    ap_set_content_type(r, tmp);
++    ap_set_content_type_ex(r, tmp, 1);
+ 
+     if (state == rsl_encoding) {
+         tmp = rsl_strdup(r, encoding_frag,
+@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r)
+ 
+     /* extract content type/encoding/language from sub-request */
+     if (sub->content_type) {
+-        ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type));
++        ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1);
+ #if MIME_MAGIC_DEBUG
+         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557)
+                     MODNAME ": subrequest %s got %s",
+diff --git a/server/config.c b/server/config.c
+index 3d11ff5..635b65d 100644
+--- a/server/config.c
++++ b/server/config.c
+@@ -418,7 +418,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r)
+     }
+ 
+     if (!r->handler) {
+-        if (r->content_type) {
++        if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) {
+             handler = r->content_type;
+             if ((p=ap_strchr_c(handler, ';')) != NULL) {
+                 char *new_handler = (char *)apr_pmemdup(r->pool, handler,
+diff --git a/server/core.c b/server/core.c
+index ffe5d16..b19763b 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -4816,7 +4816,7 @@ static int core_override_type(request_rec *r)
+     /* Check for overrides with ForceType / SetHandler
+      */
+     if (conf->mime_type && strcmp(conf->mime_type, "none"))
+-        ap_set_content_type(r, (char*) conf->mime_type);
++        ap_set_content_type_ex(r, (char*) conf->mime_type, 1);
+ 
+     if (conf->expr_handler) { 
+         const char *err;
+-- 
+2.33.0
+

backport-CVE-2024-38477-validate-hostsname.patch

@@ -0,0 +1,50 @@
+From 1d98d4db186e708f059336fb9342d0adb6925e85 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 25 Jun 2024 17:29:32 +0000
+Subject: [PATCH] Merge r1918606 from trunk:
+
+validate hostname
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918607 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/1d98d4db186e708f059336fb9342d0adb6925e85
+
+---
+ modules/proxy/proxy_util.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 541e944..3b174ad 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -2627,6 +2627,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r,
+                              apr_pstrcat(p,"URI cannot be parsed: ", *url,
+                                          NULL));
+     }
++
++    if (!uri->hostname) {
++        return ap_proxyerror(r, HTTP_BAD_REQUEST,
++                             apr_pstrcat(p,"URI has no hostname: ", *url,
++                                         NULL));
++    }
++
+     if (!uri->port) {
+         uri->port = ap_proxy_port_of_scheme(uri->scheme);
+     }
+@@ -3992,6 +3999,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+ 
+     /* Compute Host header */
+     if (dconf->preserve_host == 0) {
++        if (!uri->hostname) {
++            rc = HTTP_BAD_REQUEST;
++            goto cleanup;
++        }
+         if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
+             if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
+                 host = apr_pstrcat(r->pool, "[", uri->hostname, "]:",
+-- 
+2.33.0
+

backport-CVE-2024-39884-maintain-trusted-flag.patch

@@ -0,0 +1,309 @@
+From fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 2 Jul 2024 13:07:17 +0000
+Subject: [PATCH] Merge r1918795, r1918814 from trunk:
+
+maintain trusted flag
+
+
+* Always trust content types that we set literally
+
+Submitted by: covener, rpluem
+Reviewed by: covener, jorton, rpluem
+
+Github: closes #459
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918839 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d
+
+---
+ modules/cluster/mod_heartmonitor.c   |  2 +-
+ modules/dav/main/mod_dav.c           | 10 +++++-----
+ modules/examples/mod_example_hooks.c |  2 +-
+ modules/filters/mod_data.c           |  2 +-
+ modules/filters/mod_include.c        |  2 +-
+ modules/filters/mod_proxy_html.c     |  4 ++--
+ modules/generators/mod_cgi.c         |  2 +-
+ modules/generators/mod_cgid.c        |  2 +-
+ modules/generators/mod_info.c        |  2 +-
+ modules/generators/mod_status.c      |  4 ++--
+ modules/http/http_filters.c          |  2 +-
+ modules/http/http_protocol.c         |  4 ++--
+ modules/http/http_request.c          |  2 +-
+ modules/ldap/util_ldap.c             |  2 +-
+ modules/mappers/mod_imagemap.c       |  2 +-
+ modules/proxy/mod_proxy_balancer.c   |  2 +-
+ 16 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c
+index 53b6504..68db585 100644
+--- a/modules/cluster/mod_heartmonitor.c
++++ b/modules/cluster/mod_heartmonitor.c
+@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r)
+     hmserver.seen = apr_time_now();
+     hm_update_stat(ctx, &hmserver, r->pool);
+ 
+-    ap_set_content_type(r, "text/plain");
++    ap_set_content_type_ex(r, "text/plain", 1);
+     ap_set_content_length(r, 2);
+     ap_rputs("OK", r);
+     ap_rflush(r);
+diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c
+index a035f25..8b92de2 100644
+--- a/modules/dav/main/mod_dav.c
++++ b/modules/dav/main/mod_dav.c
+@@ -355,7 +355,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
+     r->status = status;
+     r->status_line = ap_get_status_line(status);
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     /* begin the response now... */
+     ap_rvputs(r,
+@@ -386,7 +386,7 @@ static int dav_error_response_tag(request_rec *r,
+ {
+     r->status = err->status;
+ 
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     ap_rputs(DAV_XML_HEADER DEBUG_CR
+              "<D:error xmlns:D=\"DAV:\"", r);
+@@ -544,7 +544,7 @@ DAV_DECLARE(void) dav_begin_multistatus(apr_bucket_brigade *bb,
+ {
+     /* Set the correct status and Content-Type */
+     r->status = status;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     /* Send the headers and actual multistatus response now... */
+     ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR
+@@ -2016,7 +2016,7 @@ static int dav_method_options(request_rec *r)
+ 
+     /* send the options response */
+     r->status = HTTP_OK;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     /* send the headers and response body */
+     ap_rputs(DAV_XML_HEADER DEBUG_CR
+@@ -3328,7 +3328,7 @@ static int dav_method_lock(request_rec *r)
+     (*locks_hooks->close_lockdb)(lockdb);
+ 
+     r->status = HTTP_OK;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     ap_rputs(DAV_XML_HEADER DEBUG_CR "<D:prop xmlns:D=\"DAV:\">" DEBUG_CR, r);
+     if (lock == NULL)
+diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c
+index f7ef5a5..d937906 100644
+--- a/modules/examples/mod_example_hooks.c
++++ b/modules/examples/mod_example_hooks.c
+@@ -993,7 +993,7 @@ static int x_handler(request_rec *r)
+      * Set the Content-type header. Note that we do not actually have to send
+      * the headers: this is done by the http core.
+      */
+-    ap_set_content_type(r, "text/html");
++    ap_set_content_type_ex(r, "text/html", 1);
+     /*
+      * If we're only supposed to send header information (HEAD request), we're
+      * already there.
+diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c
+index ddadd1b..4e6e636 100644
+--- a/modules/filters/mod_data.c
++++ b/modules/filters/mod_data.c
+@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+             }
+         }
+ 
+-        ap_set_content_type(r, "text/plain");
++        ap_set_content_type_ex(r, "text/plain", 1);
+ 
+     }
+ 
+diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
+index 584d8fb..2c0cc67 100644
+--- a/modules/filters/mod_include.c
++++ b/modules/filters/mod_include.c
+@@ -3972,7 +3972,7 @@ static int include_fixup(request_rec *r)
+     if (r->handler && (strcmp(r->handler, "server-parsed") == 0))
+     {
+         if (!r->content_type || !*r->content_type) {
+-            ap_set_content_type(r, "text/html");
++            ap_set_content_type_ex(r, "text/html", 1);
+         }
+         r->handler = "default-handler";
+     }
+diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
+index 7783da1..4205a61 100644
+--- a/modules/filters/mod_proxy_html.c
++++ b/modules/filters/mod_proxy_html.c
+@@ -952,7 +952,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+                         ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422)
+                                       "No i18n support found.  Install mod_xml2enc if required");
+                     enc = XML_CHAR_ENCODING_NONE;
+-                    ap_set_content_type(f->r, "text/html;charset=utf-8");
++                    ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+                 }
+                 else {
+                     /* if we wanted a non-default charset_out, insert the
+@@ -968,7 +968,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+                                                         cenc, NULL));
+                     }
+                     else /* Normal case, everything worked, utf-8 output */
+-                        ap_set_content_type(f->r, "text/html;charset=utf-8");
++                        ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+                 }
+ 
+                 ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype);
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 421124a..7d6cba9 100644
+--- a/modules/generators/mod_cgi.c
++++ b/modules/generators/mod_cgi.c
+@@ -672,7 +672,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+     /* Force sub_req to be treated as a CGI request, even if ordinary
+      * typing rules would have called it something else.
+      */
+-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
++    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+ 
+     /* Run it. */
+     rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index dddfb25..3690957 100644
+--- a/modules/generators/mod_cgid.c
++++ b/modules/generators/mod_cgid.c
+@@ -1667,7 +1667,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+     /* Force sub_req to be treated as a CGI request, even if ordinary
+      * typing rules would have called it something else.
+      */
+-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
++    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+ 
+     /* Run it. */
+     rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c
+index 1662242..a94e4e4 100644
+--- a/modules/generators/mod_info.c
++++ b/modules/generators/mod_info.c
+@@ -784,7 +784,7 @@ static int display_info(request_rec * r)
+         return DECLINED;
+     }
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     ap_rputs(DOCTYPE_XHTML_1_0T
+              "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n"
+diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
+index 5bada07..2cb38c7 100644
+--- a/modules/generators/mod_status.c
++++ b/modules/generators/mod_status.c
+@@ -273,7 +273,7 @@ static int status_handler(request_rec *r)
+     if (r->method_number != M_GET)
+         return DECLINED;
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     /*
+      * Simple table-driven form data set parser that lets you alter the header
+@@ -301,7 +301,7 @@ static int status_handler(request_rec *r)
+                     no_table_report = 1;
+                     break;
+                 case STAT_OPT_AUTO:
+-                    ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
++                    ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1);
+                     short_report = 1;
+                     break;
+                 }
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index f20aee7..60b44d7 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -1261,7 +1261,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r)
+         }
+     }
+ 
+-    ap_set_content_type(r, "message/http");
++    ap_set_content_type_ex(r, "message/http", 1);
+ 
+     /* Now we recreate the request, and echo it back */
+ 
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index c31e873..3bc666e 100644
+--- a/modules/http/http_protocol.c
++++ b/modules/http/http_protocol.c
+@@ -1443,10 +1443,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error)
+             request_conf->suppress_charset = 1; /* avoid adding default
+                                                  * charset later
+                                                  */
+-            ap_set_content_type(r, "text/html");
++            ap_set_content_type_ex(r, "text/html", 1);
+         }
+         else {
+-            ap_set_content_type(r, "text/html; charset=iso-8859-1");
++            ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1);
+         }
+ 
+         if ((status == HTTP_METHOD_NOT_ALLOWED)
+diff --git a/modules/http/http_request.c b/modules/http/http_request.c
+index d59cfe2..71ecc2b 100644
+--- a/modules/http/http_request.c
++++ b/modules/http/http_request.c
+@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
+     r->args = rr->args;
+     r->finfo = rr->finfo;
+     r->handler = rr->handler;
+-    ap_set_content_type(r, rr->content_type);
++    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+     r->content_encoding = rr->content_encoding;
+     r->content_languages = rr->content_languages;
+     r->per_dir_config = rr->per_dir_config;
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index aa0bad1..8c9e587 100644
+--- a/modules/ldap/util_ldap.c
++++ b/modules/ldap/util_ldap.c
+@@ -171,7 +171,7 @@ static int util_ldap_handler(request_rec *r)
+     st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,
+             &ldap_module);
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     if (r->header_only)
+         return OK;
+diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c
+index 206c0b6..b2dca7e 100644
+--- a/modules/mappers/mod_imagemap.c
++++ b/modules/mappers/mod_imagemap.c
+@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect)
+ 
+ static void menu_header(request_rec *r, char *menu)
+ {
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     ap_rvputs(r, DOCTYPE_HTML_3_2, "<html><head>\n<title>Menu for ",
+               ap_escape_html(r->pool, r->uri),
+diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
+index b8b452d..3c0f5a8 100644
+--- a/modules/proxy/mod_proxy_balancer.c
++++ b/modules/proxy/mod_proxy_balancer.c
+@@ -1471,7 +1471,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf,
+ 
+     if (usexml) {
+         char date[APR_RFC822_DATE_LEN];
+-        ap_set_content_type(r, "text/xml");
++        ap_set_content_type_ex(r, "text/xml", 1);
+         ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r);
+         ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r);
+         ap_rputs("  <httpd:balancers>\n", r);
+-- 
+2.33.0
+

backport-CVE-2024-40725.patch

@@ -0,0 +1,29 @@
+From a7d24b4ea9a6ea35878fd33075365328caafcf91 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 15 Jul 2024 12:08:30 +0000
+Subject: [PATCH] Merge r1919247 from trunk:
+
+copy the trusted flag from the subrequest
+
+Submitted By: covener
+Reviewed By: covener, ylavic, gbechis
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1919249 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/http/http_request.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/http/http_request.c b/modules/http/http_request.c
+index 71ecc2bbab1..7e9477be1f1 100644
+--- a/modules/http/http_request.c
++++ b/modules/http/http_request.c
+@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
+     r->args = rr->args;
+     r->finfo = rr->finfo;
+     r->handler = rr->handler;
+-    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r));
++    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(rr));
+     r->content_encoding = rr->content_encoding;
+     r->content_languages = rr->content_languages;
+     r->per_dir_config = rr->per_dir_config;

backport-Check-SSL_CTX_new-return-value.patch

@@ -0,0 +1,41 @@
+From c8c469b3a907ea263a888217d6d5c48c287205ec Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Mon, 20 Jan 2025 10:27:52 +0000
+Subject: [PATCH] Merge r1916054 from trunk:
+
+mod_ssl: Check SSL_CTX_new() return value
+
+SSL_CTX_new() will return NULL if there was an error creating a new SSL context.
+
+Submitted by: StephenWall
+Github: closes #402
+Reviewed by: jailletc36, rjung, jorton
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1923248 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/c8c469b3a907ea263a888217d6d5c48c287205ec
+---
+ modules/ssl/ssl_engine_init.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index beb5dac..b8150a9 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -704,6 +704,11 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+         TLS_server_method();  /* server */
+ #endif
+     ctx = SSL_CTX_new(method);
++    if (ctx == NULL) {
++        /* Can fail for some system/install mis-configuration. */
++        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        return ssl_die(s);
++    }
+ 
+     mctx->ssl_ctx = ctx;
+ 
+-- 
+2.33.0
+

backport-Fix-possible-crash-on-error-path.patch

@@ -0,0 +1,43 @@
+From 000cd2291d3d2c40682ec607e8d3b0711ac5a097 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Mon, 20 Jan 2025 10:24:13 +0000
+Subject: [PATCH] Merge r1921067 from trunk:
+
+* Take care for the case where nkey is NULL
+
+PR: 69358
+Reported by: <zhora.budyukin111 gmail.com>
+Submitted by: rpluem
+Reviewed by: jailletc36, rjung, jorton
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1923247 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/000cd2291d3d2c40682ec607e8d3b0711ac5a097
+---
+ modules/cache/mod_cache_socache.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/modules/cache/mod_cache_socache.c b/modules/cache/mod_cache_socache.c
+index f369004..341db53 100644
+--- a/modules/cache/mod_cache_socache.c
++++ b/modules/cache/mod_cache_socache.c
+@@ -694,9 +694,11 @@ fail:
+             return DECLINED;
+         }
+     }
+-    conf->provider->socache_provider->remove(
+-            conf->provider->socache_instance, r->server,
+-            (unsigned char *) nkey, strlen(nkey), r->pool);
++    if (nkey) {
++        conf->provider->socache_provider->remove(
++                conf->provider->socache_instance, r->server,
++                (unsigned char *) nkey, strlen(nkey), r->pool);
++    }
+     if (socache_mutex) {
+         apr_status_t status = apr_global_mutex_unlock(socache_mutex);
+         if (status != APR_SUCCESS) {
+-- 
+2.33.0
+

backport-Fix-the-handling-of-the-stickysession-configuration-parameter.patch

@@ -0,0 +1,42 @@
+From c8c5aef865dd4dfcce6606cf5a4fba1e815adb0f Mon Sep 17 00:00:00 2001
+From: Jim Jagielski <jim@apache.org>
+Date: Wed, 15 Jan 2025 12:03:59 +0000
+Subject: [PATCH]   *) Do not add a space before '|' when setting the value for
+ stickysession in the      balancer manager as this breaks the stickysession
+ configuration once a new      configuration is submitted by the balancer
+ manager. PR: 69510      trunk patch: https://svn.apache.org/r1923101
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1923145 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/c8c5aef865dd4dfcce6606cf5a4fba1e815adb0f
+
+---
+ modules/proxy/mod_proxy_balancer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
+index 6ec6383..77344c8 100644
+--- a/modules/proxy/mod_proxy_balancer.c
++++ b/modules/proxy/mod_proxy_balancer.c
+@@ -1704,7 +1704,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf,
+                        balancer->max_workers - (int)storage->num_free_slots(balancer->wslot));
+             if (*balancer->s->sticky) {
+                 if (strcmp(balancer->s->sticky, balancer->s->sticky_path)) {
+-                    ap_rvputs(r, "<td>", ap_escape_html(r->pool, balancer->s->sticky), " | ",
++                    ap_rvputs(r, "<td>", ap_escape_html(r->pool, balancer->s->sticky), "|",
+                               ap_escape_html(r->pool, balancer->s->sticky_path), NULL);
+                 }
+                 else {
+@@ -1889,7 +1889,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf,
+             ap_rputs("</tr>\n", r);
+             ap_rputs("<tr><td>Sticky Session:</td><td><input name='b_ss' id='b_ss' size=64 type=text ", r);
+             if (strcmp(bsel->s->sticky, bsel->s->sticky_path)) {
+-                ap_rvputs(r, "value =\"", ap_escape_html(r->pool, bsel->s->sticky), " | ",
++                ap_rvputs(r, "value =\"", ap_escape_html(r->pool, bsel->s->sticky), "|",
+                           ap_escape_html(r->pool, bsel->s->sticky_path), NULL);
+             }
+             else {
+-- 
+2.33.0
+

backport-Report-invalid-Options-argument-when-parsing-AllowOverride-directives.patch

@@ -0,0 +1,59 @@
+From 8486d22d82e484e2e027db30722a9b74e6c99ab9 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Fri, 14 Feb 2025 09:16:23 +0000
+Subject: [PATCH] Merge r1917017, r1923218 from trunk:
+
+* server/core.c (set_override): Catch errors returned by
+  set_allow_opts() for a parsing fail in an Options= argument.
+
+Submitted by: Zhou Qingyang <zhou1615 umn.edu>
+Github: closes #310
+
+Add a Changes entry related to r1917017
+
+While at it, fix a small style issue (tab vs spaces)
+
+Submitted by: jorton, jailletc36
+Reviewed by: rjung (reduce code drift), jorton, jailletc36
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1923804 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/8486d22d82e484e2e027db30722a9b74e6c99ab9
+
+---
+ changes-entries/github 310.txt | 3 +++
+ server/core.c                  | 6 ++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+ create mode 100644 changes-entries/github 310.txt
+
+diff --git a/changes-entries/github 310.txt b/changes-entries/github 310.txt
+new file mode 100644
+index 0000000..2d966cd
+--- /dev/null
++++ b/changes-entries/github 310.txt	
+@@ -0,0 +1,3 @@
++  *) core: Report invalid Options= argument when parsing AllowOverride
++     directives.
++     Github #310 [Zhou Qingyang <zhou1615 umn.edu>]
+diff --git a/server/core.c b/server/core.c
+index e8ef728..1401863 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -1831,8 +1831,10 @@ static const char *set_override(cmd_parms *cmd, void *d_, const char *l)
+         }
+         else if (!ap_cstr_casecmp(k, "Options")) {
+             d->override |= OR_OPTIONS;
+-            if (v)
+-                set_allow_opts(cmd, &(d->override_opts), v);
++            if (v) {
++                if ((err = set_allow_opts(cmd, &(d->override_opts), v)) != NULL)
++                    return err;
++            }
+             else
+                 d->override_opts = OPT_ALL;
+         }
+-- 
+2.33.0
+

backport-fix-LogFormat-directive-merging.patch

@@ -0,0 +1,40 @@
+From 9248113bed1c5c0c610c7108b447314cf2847fdc Mon Sep 17 00:00:00 2001
+From: Jim Jagielski <jim@apache.org>
+Date: Tue, 7 Jan 2025 15:07:17 +0000
+Subject: [PATCH]   *) mod_log_config: Fix LogFormat directive merging
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1922961 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/9248113bed1c5c0c610c7108b447314cf2847fdc
+
+---
+ changes-entries/pr65222.txt      | 2 ++
+ modules/loggers/mod_log_config.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+ create mode 100644 changes-entries/pr65222.txt
+
+diff --git a/changes-entries/pr65222.txt b/changes-entries/pr65222.txt
+new file mode 100644
+index 0000000..8efffd6
+--- /dev/null
++++ b/changes-entries/pr65222.txt
+@@ -0,0 +1,2 @@
++  *) mod_log_config: Fix merging for the "LogFormat" directive.
++     PR: 65222. [Michael Kaufmann <mail michael-kaufmann.ch>]
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index aba01f2..8a3c64a 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -1263,7 +1263,7 @@ static void *merge_config_log_state(apr_pool_t *p, void *basev, void *addv)
+         add->default_format_string = base->default_format_string;
+         add->default_format = base->default_format;
+     }
+-    add->formats = apr_table_overlay(p, base->formats, add->formats);
++    add->formats = apr_table_overlay(p, add->formats, base->formats);
+ 
+     return add;
+ }
+-- 
+2.33.0
+

backport-fix-X509-leak-and-Increase-MAX_CONCURRENCY-hard-limi.patch

@@ -0,0 +1,78 @@
+From 84a9b978e7a502e3d93e2d757af67f8f303cb615 Mon Sep 17 00:00:00 2001
+From: Jim Jagielski <jim@apache.org>
+Date: Wed, 15 Jan 2025 11:51:28 +0000
+Subject: [PATCH] svn merge -c 1910518,1910847,1912477,1918297
+ ^/httpd/httpd/trunk .   *) Easy patches: synch 2.4.x and trunk         - ab:
+ Increase MAX_CONCURRENCY hard limit (from 20K to 200K)         - ab: Fix X509
+ * leak         - dav/fs/dbm.c: Remove error message references to "property"
+ databases         - httpd.h: Fix comment
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1923142 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:delete non-existent file STATUS
+Reference:https://github.com/apache/httpd/commit/84a9b978e7a502e3d93e2d757af67f8f303cb615
+---
+ include/httpd.h      | 2 +-
+ modules/dav/fs/dbm.c | 4 ++--
+ support/ab.c         | 3 ++-
+ 3 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/httpd.h b/include/httpd.h
+index 61e02a9..3ee836a 100644
+--- a/include/httpd.h
++++ b/include/httpd.h
+@@ -1114,7 +1114,7 @@ struct request_rec {
+      */
+     int double_reverse;
+     /** Request flags associated with this request. Use
+-     * AP_REQUEST_GET_FLAGS() and AP_REQUEST_SET_FLAGS() to access
++     * AP_REQUEST_GET_BNOTE() and AP_REQUEST_SET_BNOTE() to access
+      * the elements of this field.
+      */
+     ap_request_bnotes_t bnotes;
+diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c
+index 347d75d..39ab4ad 100644
+--- a/modules/dav/fs/dbm.c
++++ b/modules/dav/fs/dbm.c
+@@ -100,7 +100,7 @@ static dav_error * dav_fs_dbm_error(dav_db *db, apr_pool_t *p,
+     /* There might not be a <db> if we had problems creating it. */
+     if (db == NULL) {
+         errcode = 1;
+-        errstr = "Could not open property database.";
++        errstr = "Could not open database.";
+         if (APR_STATUS_IS_EDSOOPEN(status))
+             ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576)
+             "The DBM driver could not be loaded");
+@@ -147,7 +147,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
+                      "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
+                              err->reason, err->msg);
+         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
+-                "Could not load library for property database.");
++                "Could not load library for database.");
+     }
+     if ((status = apr_dbm_open2(&file, driver, pathname,
+                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
+diff --git a/support/ab.c b/support/ab.c
+index 3aa2660..eb8845c 100644
+--- a/support/ab.c
++++ b/support/ab.c
+@@ -292,7 +292,7 @@ struct data {
+ #define ap_max(a,b) (((a)>(b))?(a):(b))
+ #define ap_round_ms(a) ((apr_time_t)((a) + 500)/1000)
+ #define ap_double_ms(a) ((double)(a)/1000.0)
+-#define MAX_CONCURRENCY 20000
++#define MAX_CONCURRENCY 200000
+ 
+ /* --------------------- GLOBALS ---------------------------- */
+ 
+@@ -748,6 +748,7 @@ static void ssl_proceed_handshake(struct connection *c)
+                              SSL_get_version(c->ssl),
+                              SSL_CIPHER_get_name(ci),
+                              pk_bits, sk_bits);
++                if (cert) X509_free(cert);
+             }
+ #if OPENSSL_VERSION_NUMBER >= 0x10002000L
+             if (ssl_tmp_key == NULL) {
+-- 
+2.33.0
+

httpd.spec

@@ -8,7 +8,7 @@
 Name:             httpd
 Summary:          Apache HTTP Server
 Version:          2.4.58
-Release:          4
+Release:          9
 License:          ASL 2.0
 URL:              https://httpd.apache.org/
 Source0:          https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -77,6 +77,23 @@ Patch23:          backport-CVE-2023-38709-header-validation-after-content.patch
 Patch24:          backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch
 Patch25:          backport-remove-dependency-on-xmlstring-header.patch
 Patch26:          backport-only-allocate-a-heap-heap-buffer.patch
+Patch27:          backport-CVE-2024-36387-mod_http2-early-exit-if-bb-is-null.patch
+Patch28:          backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch
+Patch29:          backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch
+Patch30:          backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch
+Patch31:          backport-CVE-2024-38473-fix-comparsion-of-local-path.patch
+Patch32:          backport-CVE-2024-38473-fix-the-filename-redirected.patch
+Patch33:          backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch
+Patch34:          backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch
+Patch35:          backport-CVE-2024-38477-validate-hostsname.patch
+Patch36:          backport-CVE-2024-39884-maintain-trusted-flag.patch
+Patch37:          backport-CVE-2024-40725.patch
+Patch38:          backport-fix-LogFormat-directive-merging.patch
+Patch39:          backport-fix-X509-leak-and-Increase-MAX_CONCURRENCY-hard-limi.patch
+Patch40:          backport-Fix-the-handling-of-the-stickysession-configuration-parameter.patch
+Patch41:          backport-Fix-possible-crash-on-error-path.patch
+Patch42:          backport-Check-SSL_CTX_new-return-value.patch
+Patch43:          backport-Report-invalid-Options-argument-when-parsing-AllowOverride-directives.patch
 
 BuildRequires:    gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
 BuildRequires:    zlib-devel libselinux-devel lua-devel brotli-devel
@@ -194,7 +211,7 @@ sed 's/@MPM@/%{mpm}/' < $RPM_SOURCE_DIR/httpd.service.xml \
 xmlto man ./httpd.service.xml
 
 %build
-%ifarch loongarch64
+%ifarch loongarch64 sw_64
 %_update_config_guess
 %_update_config_sub
 %endif
@@ -514,7 +531,42 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Wed Jun 08 2024 yueyuankun <yueyuankun@kylinos.cn> - 2.4.58-4
+* Wed Apr 16 2025 xingwei <xingwei14@h-partners.com> - 2.4.58-9
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:mod_log_config: Fix LogFormat directive merging
+       Fix X509 leak and Increase MAX_CONCURRENCY hard limit
+       mod_proxy_balancer: Fix the handling of the stickysession
+       mod_cache_socache: Fix possible crash on error path
+       mod_ssl: Check SSL_CTX_new() return value
+       core: Report invalid Options argument when parsing AllowOverride directives
+
+* Sat Mar 15 2025 mahailiang <mahailiang@uniontech.com> - 2.4.58-8
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix build error for sw_64
+
+* Fri Jul 26 2024 Han Jinpeng <hanjinpeng@kylinos.cn> - 2.4.58-7
+- Type:CVE
+- ID:CVE-2024-40725
+- SUG:NA
+- DESC:fix CVE-2024-40725
+
+* Mon Jul 08 2024 chengyechun <chengyechun1@huawei.com> - 2.4.58-6
+- Type:CVE
+- ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
+- SUG:NA
+- DSEC:fix some CVEs
+
+* Tue Jul 02 2024 wangziliang <wangziliang@kylinos.cn> - 2.4.58-5
+- Type:CVE
+- ID:CVE-2024-36387
+- SUG:NA
+- DESC:fix CVE-2024-36387
+
+* Sat Jun 08 2024 yueyuankun <yueyuankun@kylinos.cn> - 2.4.58-4
 - Type:NA
 - ID:NA
 - SUG:NA