Repository navigation
fix(httpd): upgrade to 2.4.71 to address CVE-2026-109163 - #20164
Open
Kanishk Bansal (Kanishk-Bansal) wants to merge 1 commit into
Open
Kanishk Bansal (Kanishk-Bansal) wants to merge 1 commit into
Kanishk Bansal (Kanishk-Bansal) wants to merge 1 commit into
Conversation
Bump the Fedora dist-git pin to f44 httpd-2.4.71: https://src.fedoraproject.org/rpms/httpd/c/dd036578128f894e8d7a7c95a5968cee9be4bbb7 f43 is still on 2.4.69, and the f44 commit differs from our current f43 pin only by the version bump. Fixes CVE-2026-109163 (mod_vhost_alias off-by-one stack write). The other two 2.4.71 CVEs, CVE-2026-119618 (mod_http2) and CVE-2026-106023 (mod_md), do not apply to this package because httpd is built with --disable-http2 and --disable-md; those modules ship from the separate mod_http2 and mod_md packages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Kanishk Bansal (Kanishk-Bansal)
requested a review
from a team
as a code owner
November 12, 2026 04:35
Kanishk Bansal (Kanishk-Bansal)
added
4.0
Author
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the httpd 2.4.71 update.
No open issues 🎉
What changed in this PR
Upgrades Azure Linux’s httpd package from 2.4.69 to 2.4.71 to address CVE-2026-109163 in mod_vhost_alias. Fixes for the separately packaged mod_http2 and mod_md modules remain in companion PRs.
Changes:
- Moves the upstream pin to Fedora f44’s 2.4.71 commit.
- Refreshes the component lock and rendered spec.
- Updates source archive and signature checksums for 2.4.71.
| File | Description |
|---|---|
specs/h/httpd/sources |
Updates archive and signature checksums. |
specs/h/httpd/httpd.spec |
Updates the version and upstream changelog. |
locks/httpd.lock |
Refreshes commit pins and input hashes; removes the manual bump. |
base/comps/httpd/httpd.comp.toml |
Pins the Fedora f44 commit and documents the selection. |
Review effort: Balanced
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrade
httpdfrom 2.4.69 to 2.4.71 by moving the Fedora dist-git pin from f43 to f44dd036578128f.f43 is still on 2.4.69. The f44 commit is the 2.4.69 spec we already ship with only the version bumped (plus the changelog entry), so nothing else changes in packaging.
CVEs addressed (1)
Other 2.4.71 CVEs, handled in separate PRs
The httpd spec builds with
--disable-http2and--disable-md, so the bundled copies of those modules are never shipped from this package. Their fixes need to go into the standalone packages:None of the three CVEs exist in Astrolabe yet, so there is nothing to claim for this PR.
Changes
base/comps/httpd/httpd.comp.toml: pinupstream-commit = dd036578128f…(Fedora f44)locks/httpd.lock: regenerated (the old import commit is only in f43 history)specs/h/httpd/: re-renderedTesting
httpd-2.4.71-1.2.1.azl4httpd-2.4.71.tar.bz2(sha512 matchessources) has the>=bound inmod_vhost_alias.chttpd -tOK, aVirtualDocumentRootvhost serves content, an 8180-byte Host header gets a 404, the server keeps serving anderror_loghas no crashesazldev comp update --check-only -p httpdis clean