Apache HTTP Server 2.4.69 has been released, notable for not including any new CVEs, and instead emphasizing proactive hardening measures. Key improvements include dropping legacy RFC 2069 from its digest-auth rewrite, fixing an HTTP/2 GOAWAY bug that previously dropped responses, and transitioning the test framework from Perl to Python. This release, described as the most stable version to date, focuses on reinforcing security rather than addressing previous vulnerabilities, a shift from the recent trend of patches for multiple security issues. While lacking new features, the focus on maintenance-mode stability is a welcome change, especially following a series of releases that highlighted various vulnerabilities

Apache HTTP Server 2.4.69 Released: No New CVEs, Focus on Hardening

Apache HTTP Server 2.4.69 and stands out for a surprising reason: it ships with no new CVEs. Instead of chasing freshly patched vulnerabilities, the project focused on proactive hardening, dropping legacy RFC 2069 from its digest-auth rewrite, fixing a data-dropping HTTP/2 GOAWAY bug, and disabling a sensitive status handler by default. The release also ports the project's decades-old Perl test framework to Python and pytest, and adds OpenSSL 4 support plus a pile of smaller crash and protocol-abuse fixes. It's available now for download, requiring APR 1.5.x minimum, with no new features but a welcome return to maintenance-mode stability.

Apache HTTP Server 2.4.69 Released: No New CVEs, Focus on Hardening @ Linux Compatible