CVS commit: pkgsrc/www/apache24

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Nov 11 13:56:01 UTC 2026

Modified Files:
        pkgsrc/www/apache24: Makefile distinfo

Log Message:
www/apache24: update to 2.4.71

Apache 2.4.71 (2026-11-11)

Fixes three security problems.

* CVE-2026-119618 (critical): mod_http2: heap corruption and RCE in
  assign_headers

  Concurrent Execution using Shared Resource with Improper Synchronization
  vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can
  lead to RCE.

 This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
 Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

* CVE-2026-106023 (important): mod_md NULL pointer dereference leads to
  child process crash

  NULL pointer dereference vulnerability in Apache HTTP Server's mod_md
  during HTTP request processing.

  This issue affects Apache HTTP Server: from 2.4.30 through 2.4.70.

* CVE-2026-109163 (low): mod_vhost_alias 1 byte stack buffer overwrite
  (after CVE-2026-63292)

    Stack-based buffer overflow vulnerability in Apache HTTP Server's
    mod_vhost_alias (after CVE-2026-63292)

    This issue affects Apache HTTP Server: 2.4.69 and 2.4.70.


To generate a diff of this commit:
cvs rdiff -u -r1.151 -r1.152 pkgsrc/www/apache24/Makefile
cvs rdiff -u -r1.74 -r1.75 pkgsrc/www/apache24/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/apache24/Makefile
diff -u pkgsrc/www/apache24/Makefile:1.151 pkgsrc/www/apache24/Makefile:1.152
--- pkgsrc/www/apache24/Makefile:1.151  Wed Nov 11 11:56:12 2026
+++ pkgsrc/www/apache24/Makefile        Wed Nov 11 13:56:01 2026
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile,v 1.151 2026/11/11 11:56:12 wiz Exp $
+# $NetBSD: Makefile,v 1.152 2026/11/11 13:56:01 taca Exp $
 #
 # When updating this package, make sure that no strings like
 # "PR 12345" are in the commit message. Upstream likes
 # to reference their own PRs this way, but this ends up
 # in NetBSD GNATS.
 
-DISTNAME=      httpd-2.4.70
+DISTNAME=      httpd-2.4.71
 PKGNAME=       ${DISTNAME:S/httpd/apache/}
 PKGREVISION=   1
 CATEGORIES=    www

Index: pkgsrc/www/apache24/distinfo
diff -u pkgsrc/www/apache24/distinfo:1.74 pkgsrc/www/apache24/distinfo:1.75
--- pkgsrc/www/apache24/distinfo:1.74   Tue Nov 10 10:30:23 2026
+++ pkgsrc/www/apache24/distinfo        Wed Nov 11 13:56:01 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.74 2026/11/10 10:30:23 adam Exp $
+$NetBSD: distinfo,v 1.75 2026/11/11 13:56:01 taca Exp $
 
-BLAKE2s (httpd-2.4.70.tar.bz2) = c184cef628363ff01b3c5597abad9442d655f9b0b1fd9c7ea50481615a287bfe
-SHA512 (httpd-2.4.70.tar.bz2) = bcbbda8fba5a3e59d6a8b88551d401ff62f2df6bfbb5f6cfac9479ac1aa14a433d490a09e21ad164502a30bd747b43e67c7e43df4412f5dc40e1723a35e3398d
-Size (httpd-2.4.70.tar.bz2) = 8612617 bytes
+BLAKE2s (httpd-2.4.71.tar.bz2) = e2451c014752264fa0b98e860c850122559e5c084dafe6a51c7da818fb548bf0
+SHA512 (httpd-2.4.71.tar.bz2) = b0eca2692e7672226e9b80e21ad64d7eda48bd5f3a1b774e3719baaa8a38e618e0ba5a9ea4fd077db306699d6b77d4b122a1f5fdc330a105d29ce6fc96ed167e
+Size (httpd-2.4.71.tar.bz2) = 8618142 bytes
 SHA1 (patch-aa) = 9a66685f1d2e4710ab464beda98cbaad632aebf9
 SHA1 (patch-ad) = dd4dbffaa8d784bbbf37b85e17977ff0c73e9074
 SHA1 (patch-ae) = 0a54d96ca77394b1ca725df76819caa95c381f39