Log message:
www/apache24: reset PKGREVISION

Log message:
www/apache24: update to 2.4.71

Apache 2.4.71 (2026-11-11)

Fixes three security problems.

* CVE-2026-119618 (critical): mod_http2: heap corruption and RCE in
  assign_headers

  Concurrent Execution using Shared Resource with Improper Synchronization
  vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can
  lead to RCE.

 This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
 Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

* CVE-2026-106023 (important): mod_md NULL pointer dereference leads to
  child process crash

  NULL pointer dereference vulnerability in Apache HTTP Server's mod_md
  during HTTP request processing.

  This issue affects Apache HTTP Server: from 2.4.30 through 2.4.70.

* CVE-2026-109163 (low): mod_vhost_alias 1 byte stack buffer overwrite
  (after CVE-2026-63292)

    Stack-based buffer overflow vulnerability in Apache HTTP Server's
    mod_vhost_alias (after CVE-2026-63292)

    This issue affects Apache HTTP Server: 2.4.69 and 2.4.70.

Log message:
*: recursive bump for icu 79

Log message:
apache24: updated to 2.4.70

Apache 2.4.70

*) mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows.

*) mod_cgid: Increase limits for number and length of
   environment variables, URI and arguments.
   [Emmanuel Dreyfus <manu netbsd.org>, Joe Orton]

*) mod_substitute: Fix an integer overflow that can happen in very special
   setups.

*) mod_cache: Do not store a response whose "Vary: *" was set via
   "Header always".

*) mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which
   under-reserved space for the stored key length field, written as
   apr_size_t but sized as int.

Log message:
www/apache24: update to 2.4.69

Apache 2.4.69 (2026-10-01)

  *) Fix the tar icon in the documentation so that its background is
     transparent.  #70238.  [Jeffery To <jeffery.to gmail.com>]

  *) mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore,
     X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1.
     #70205.  [Craig Lorentzen <crlorent amazon.com>]

  *) mod_cgid, mod_ssl, mod_md: Various hardening fixes.  [Various authors]

  *) mod_md: MDServerStatus is now disabled by default.  [Joe Orton]

  *) mod_auth_digest: Fix compatibility with expression-based AuthName.
     #59039.  [Eric Covener]

  *) mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory
     handling and client nonce handling; "authdigest-opaque" mutex is
     now longer needed.  [Joe Orton]

  *) mod_lbmethod_heartbeat: Use safe integer parsing with range
     validation, replacing atoi().  [Sayed Kaif <metsw24 gmail.com>]

  *) core: Reject control characters in the reason phrase of interim
     responses.  Only accept space as status-code separator.  [Joe Orton]

  *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
     large for the K/M/G suffix.  [Joe Orton]

  *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
     directive with a missing closing delimiter.  [Joe Orton]

  *) mod_dir: Fix a crash in fixup_dir for a request not mapped to any type.
     #68527.  [Eric Covener]

  *) mod_http2: Do not drop an in-flight response when a client sends a
     graceful GOAWAY (error code 0) while streams it opened are still
     being processed. The session now drains open streams instead of
     tearing down immediately, which async MPMs hit far more than event.
     Fixes a silently dropped response; RFC 9113 compliant. [Jim Jagielski]

  *) mod_md: OpenSSL 4 compatibility.

  *) pytest_suite: Port of the old PERL test framework to Python
     and pytest. Now included in the source tree under ./test
     [Jim Jagielski]

Log message:
*: recursive bump for pcre2 10.49

Log message:
*: revbump for pcre2 symbol versioning change

Log message:
*: recursive bump for pcre2 10.48