* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 60c49e56542d40a4ec985adab033f12d7e804957
@ 2026-05-05 9:48 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-05-05 9:48 UTC (permalink / raw)
To: ipfire-scm
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 70484 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 60c49e56542d40a4ec985adab033f12d7e804957 (commit)
via 67604dfee7798d0df8b98c8871e52cbd9141a1fb (commit)
via da3d30c4bd37c6e3f3a177676a8d33771d67374e (commit)
via 584e8f3cce0c6a612788e38aa56757bfc8f11a8d (commit)
via 297697787d06c49c8e44240402e017002cf6ea69 (commit)
via 9f9df41296504060922a32d55a6c15eb4a7f1e87 (commit)
from e51467136c8b04f739f6c4173e70d1a83f3af24b (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 60c49e56542d40a4ec985adab033f12d7e804957
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Tue May 5 09:48:13 2026 +0000
core202: Ship Apache2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 67604dfee7798d0df8b98c8871e52cbd9141a1fb
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon May 4 19:40:56 2026 +0200
curl: Update to version 8.20.0
- Update from version 8.19.0 to 8.20.0
- Update of rootfile
- Changelog
8.20.0
Changes:
async-thrdd: use thread queue for resolving
build: make NTLM disabled by default
cmake: drop support for CMake 3.17 and older
lib: add thread pool and queue
lib: drop support for < c-ares 1.16.0
lib: make SMB support opt-in
multi.h: add CURLMNWC_CLEAR_ALL
rtmp: drop support
Bugfixes:
altsvc: cap the list at 5,000 entries
altsvc: drop the prio field from the struct
altsvc: skip expired entries read from file
asyn-ares: connect async
asyn-ares: drop orphaned variable references
asyn-ares: fix HTTPS-lookup when not on port 443
asyn-thrdd: drop redundant `result` check
asyn-thrdd: fix clang-tidy unused value warning
async-ares: fix query counter handling
autotools: limit checksrc target to ignore non-repo test sources
badwords-all: exit with correct code on errors
badwords: combine the whitelisting into a single regex
badwords: detect the the and with with
badwords: only check comments and strings in source code
badwords: rework exceptions, fix many of them
boringssl: fix more coexist cases with Schannel/WinCrypt
build: adjust/add casts to fix `-Wformat-signedness`
build: assume `snprintf()` in `mprintf`, drop feature check
build: compiler warning silencing tidy-ups
build: drop `openssl` module dependency for BoringSSL from `libcurl.pc`
build: drop duplicate `pthread.h` includes
build: drop redundant `USE_QUICHE` guards
build: enable `-Wimplicit-int-enum-cast` compiler warning, fix issues
build: fix `-Wformat-signedness` by adjusting printf masks
build: link `bcrypt.lib` via vcxproj files
build: skip detecting `pipe2()` for Apple targets
cf-https-connect: silence `-Wimplicit-int-enum-cast` with HTTPS-RR
cf-https-connect: silence `-Wimplicit-int-enum-cast` with HTTPS-RR
cf-ip-happy: limit concurrent attempts
cf-socket: avoid low risk integer overflow on ancient Solaris
cfilters: fix Curl_pollset_poll() return code mixup
clang-tidy: avoid assignments in `if` expressions
clang-tidy: enable more checks, fix fallouts
cmake: add CMake Config-based dependency detection
cmake: add CMake Config-based dependency detection for c-ares, wolfSSL
cmake: document functions used from Windows system DLLs
cmake: enable pthreads for BoringSSL/AWS-LC
cmake: resolve targets recursively when generating `libcurl.pc`
cmake: rework binutils ld hack to not read `LOCATION` property
cmake: silence bad library `Threads::Threads` warning
cmake: use `AIX` built-in variable (with CMake 4.0+)
config2setopts: make --capath work in proxy disabled builds
configure: fix `--with-ngtcp2=<path>` option for crypto libs
configure: fix LibreSSL ngtcp2 1.15.0+ crypto lib selection logic
configure: prefer dependency-specific variables over `$withval`
configure: remove superfluous experimental warning for HTTP/3
configure: silence useless clang warnings in C89 builds
configure: tidy up comments
connect: fix typo on error message
cookie: fix rejection when tabs in value
curl-wolfssl.m4: fix to use the correct value for pkg-config directory
curl.h: replace macros with C++-friendly method to enforce 3 args
curl_ctype.h: fix spelling in a couple of locally used macros
curl_get_line: error out on read errors
curl_get_line: fix potential infinite loop when filename is a directory
curl_ngtcp2: extend and update callbacks for 1.22.0+
curl_ntlm_core: drop redundant PP condition
curl_ntlm_core: use wolfCrypt DES API with wolfSSL
curl_setup.h: drop stray/unused `USE_OPENSSL_QUIC` guard
curl_sha512_256: support delegating to wolfSSL API
curl_version_info.md: clarify age details
CURLOPT_HAPROXY_CLIENT_IP.md: mention assumption on data format
CURLOPT_RTSP_SESSION_ID.md: clarify reuse "dangers"
CURLOPT_RTSP_SESSION_ID.md: expand the comment
CURLOPT_RTSP_SESSION_ID.md: minor language fix
CURLOPT_SOCKS5_AUTH.md: an access property
CURLOPT_SSL_CTX_FUNCTION.md: expand on effects connection reuse
CURLOPT_UPLOAD_FLAGS.md: expand
curlx_now(), prevent zero timestamp
DEPRECATE: fix minor release number typo
digest: pass in the username quoted (as well)
dns: https-eyeballing async
dnscache: own source file, improvements
docs/cmdline-opts: tidy up retry-connrefused
docs/lib: fix typos
docs/libcurl: improve easy setopt examples
docs: clarify retry-max-time timing
docs: CURLOPT_LOGIN_OPTIONS is a login property
docs: enable more compiler warnings for C snippets, fix 3 finds
docs: list more dependencies for running Python HTTP tests
docs: mention more zip bomb precautions
docs: minor wording tweaks
docs: noproxy wants the punycoded hostname version
docs: SSH host verification is done at connect time
docs: use the correct CURLOPT_WRITEFUNCTION signature
doh: fix memory-leak when doing a second DoH resolve
doh: remove superfluous doh_req check
examples/websocket: fix to sleep more on Windows
examples: drop warning silencers no longer hit
examples: fix typo in comment
file: init fd to -1 to prevent close fd 0 on early failure
fopen: for temp files, inherit permissions only for owner
ftp: do not strdup DATA hostname
ftp: make the MDTM date parser stricter (again)
ftp: reject PWD responses containing control characters
gcc: guard `#pragma diagnostic` in core code for <4.6
generate.bat: remove extra % from VC11 and VC12 runs
genserv.pl: make external calls safe
getinfo: initialize `PureInfo` field `used_proxy`
getinfo: repair CURLINFO_TLS_SESSION
gnutls: fix clang-tidy warning with !verbose
gtls: fail for large files in `load_file()`
h3: HTTPS-RR use in HTTP/3
Happy Eyeballs: add resolution time delay
haproxy: use correct ip version on client supplied address
hostip: clear the sockaddr_in6 structure before use
hostip: init the curl_jmpenv_lock appropriately
hostip: resolve user supplied ip addresses
HSTS: cap the list
hsts: make the HSTS read callback handle name dupes
hsts: skip expired HSTS entries read from file
hsts: when a dupe host adds subdomains, use that
http2: clear the h2 session at delete
http2: prevent secure schemes pushed over insecure connections
http2: return error on OOM in push headers
HTTP3.md: drop outdated mentions of OpenSSL-QUIC
http: clear credentials better on redirect
http: clear digest nonce on cross-origin redirect
http: clear the proxy credentials as well on port or scheme change
http: fix auth_used and auth_avail
http: fix Curl_compareheader for multi value headers
http: make Curl_compareheader handle multiple commas in header
http: on 303, switch to GET
http: use header_has_value() instead of duplicate code
imap: reset the UIDVALIDITY state between transfers
include: drop badword from public headers
INSTALL.md: update Cygwin instructions
keylog.h: replace literal number with macro in declaration
keylog: drop unused/redundant includes and guards
ldap: drop duplicate `ldap_set_option()` on Windows
ldap: fix to initialize cleartext connection on Windows
lib1560: fix comment typo
lib1960: fix test failure
lib: accept larger input to md5/hmac/sha256/sha512 functions
lib: always use Curl_1st_fatal instead of Curl_1st_err
lib: fix typos in comments
lib: make resolving HTTPS DNS records reliable:
lib: minor comment typos
lib: move request specific allocations to the request struct
lib: replace `PRI*32` printf masks with C89 ones
libssh2: allocate libssh2-friendly memory in kbd_callback
libssh2: fix error handling on quote errors
libssh: fix 64-bit printf mask for mingw-w64 <=6.0.0
libssh: fix `-Wsign-compare` in 32-bit builds
libssh: path length precaution
libssh: propagate error back in SFTP function
libtest: drop duplicate include
location/follow: mention netrc
man: fix argument type for `CURLSHOPT_[UN]SHARE` options
mbedtls: cleanup more without care for 'initialized'
mbedtls: fix ECJPAKE matching
mbedtls: remove failf() call with first argument as NULL
md4, md5: switch to wolfCrypt API in wolfSSL builds
mime: only allow 40 levels of calls
misc: fix code quality findings
mk-ca-bundle.pl: make `ca-bundle.crt` timestamp match `certdata.txt`'s
multi: enhance pending handles fairness
multi: fix connection retry for non-http
multi: improve wakeup and wait code
netrc: find login-less password when user is given in URL
netrc: remove unused parsenetrc() macro for netrc-disabled
netrc: skip malformed macdef lines
openssl channel_binding: lookup digest algorithm without NID
openssl: drop obsolete SSLv2 logic
openssl: fix build with 4.0.0-beta1 no-deprecated
openssl: fix memory leaks in ECH code (OpenSSL 3)
openssl: fix unused variable warnings in !verbose builds
openssl: trace count of found / imported Windows native CA roots
OS400: add new definitions to the ILE/RPG binding.
os400sys: fix typo in comment (symmetry)
parsedate: bsearch the time zones
parsedate: fix wrong treatment of "military time zones"
parsedate: refactor
perl: harden external command invocations
progress: count amount of data "delivered" to application
protocol.h: fix the CURLPROTO_MASK
protocol: disable connection reuse for SMB(S)
protocol: use scheme names lowercase
proxy: chunked response, error code
pytest: add additional quiche check for flaky test_05_01
pytest: check 429 handling
rand: use `BCryptGenRandom()` in UWP builds
ratelimit: reset on start
request: reset resp_trailer in new requests
runtests: skip setting ed25519 SSH key format
rustls: fix memory leak on repeated SSLKEYLOGFILE fails
rustls: handle EOF during initial handshake
schannel: increase renegotiation timeout to 60 seconds
scripts: drop redundant double-quotes: `"$var"` -> `$var` (Perl)
scripts: harden / tidy up more Perl `system()` calls
sendf: fix CR detection if no LF is in the chunk
setopt: fix typos in comments
setopt: move CURLOPT_CURLU
setup connection filter: mark as setup
sha256, sha512_256: switch to wolfCrypt API
sha256: support delegating to wolfSSL API
share: concurrency handling, easy updates
share: do bitshifts after the type is checked to be valid
socks: reject zero-length GSSAPI/SSPI tokens from proxy
socks: use dns filter for resolving
spelling: fix typos
src: use ftruncate() unconditionally
sshserver.pl: harden more `system()` calls
sshserver.pl: pass command-line to `system()` safely
strerr: correct the strerror_s() return code condition
sws: fix potential OOB write
synctime: fix off-by-one read and write to a read-only buffer (Windows)
test 766: flag as timing-dependent
test1675: unit tests for URL API helper functions
test459: switch to mode="warn" for stderr check
testcurl.pl: replace shell commands with Perl `rmtree()`
tests/unit/README: describe how to unit test static functions
tests: avoid infinite recursion for `make check`
tests: use %b64[] instead of "raw" base64
tool: check for curlinfo->age when determining if ssh backend
tool: fix memory mixups
tool: fix retries in parallel mode
tool: fix two more allocator mismatches
tool_cb_hdr: only truncate etags output when regular file
tool_cb_rea: make waitfd() return void
tool_cb_wrt: fix no-clobber error handling
tool_cfgable: free the SSL signature algorithms
tool_formparse: propagate my_get_line errors when reading headers
tool_getparam: use correct free function for libcurl memory
tool_ipfs: accept IPFS gateway URL without set port number
tool_msgs: avoid null pointer deref for early errors
tool_operate: actually apply the --parallel-max-host limit
tool_operate: drop the scheme-guessing in the -G handling
tool_operate: fix condition for loading `curl-ca-bundle.crt` (Windows)
tool_operate: fix memory-leak on failed uploads
tool_operate: fix minor memory-leak on early error
tool_operate: reset the upload glob counter for next URL
tool_operhlp: fix `add_file_name_to_url()` result on OOM
tool_operhlp: iterate through all slashes to find name
tool_operhlp: propagate low-level OOM in `add_file_name_to_url()`
tool_setopt: return error on OOM correctly
tool_urlglob: fix memory-leak on glob range overflow
top-complexity: prevent filename-based shell injection risk
transfer: clear the old autoreferer
transfer: clear the URL pointer in OOM to avoid UAF
transfer: enable custom methods again on next transfer
transfer: enhance secure check
unit1675: fix `-Wformat-signedness`
url: do not reuse a non-tls starttls connection if new requires TLS
url: improve connection reuse on negotiate
url: init req.no_body in DO so that it works for h2 push
url: set default upload flags to CURLULFLAG_SEEN
url: use the socks type for socks proxy
url: use URL for lowercase URL even in comments
urlapi: fix handling of "file:///"
urlapi: make dedotdotify handle leading dots correctly
urlapi: same origin tests
urlapi: stop extracting hostname from file:// URLs on Windows
urlapi: verify the last letter of a scheme when set explicitly
urldata.h: fix typo and lingering backtick
urldata: connection bit ipv6_ip is wrong
urldata: import port types and conn destination format
urldata: make hstslist only present in HSTS builds
urldata: make speeder_c uint32
urldata: move cookiehost to struct SingleRequest
urldata: remove trailers_state
vquic: fix variable name in fallback code
vtls: fix comment typos and tidy up a type
vtls: log when key logging is enabled.
vtls_scache: check reentrancy
vtls_scache: include cert_blob independently of verifypeer
wolfssl: document v5.0.0 (2021-11-01) as minimum required
wolfssl: fix `-Wmissing-prototypes`
wolfssl: fix handling of abrupt connection close
ws: fix a blocking curl_ws_send() to report written length correctly
x509asn1: fix to return error in an error case from `encodeOID()`
x509asn1: fixed and adapted for ASN1tostr unit testing
x509asn1: improve encodeOID
8.19.0
Changes:
BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026
cmake: add `CURL_BUILD_EVERYTHING` option
mqtt: initial support for MQTTS
tool: support fractions for --limit-rate and --max-filesize
tool_cb_hdr: with -J, use the redirect name as a backup
vquic: drop support for OpenSSL-QUIC
windows: add build option to use the native CA store
windows: bump minimum to Vista (from XP)
Bugfixes:
altsvc: only accept 17 byte dates from files
asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails
async-ares: blocking resolve timeout handling, better
badwords: move into ./scripts, speed up
build: add missing `GENERATEDCERTS` files
build: adjust minimum version for some clang picky warnings
build: check `MSG_NOSIGNAL` directly, drop detection and interim macro
build: constify `memchr()`/`strchr()`/etc result variables (cont.)
build: detect and include `inttypes.h` again
build: do not include wolfSSL header in `curl_setup.h`
build: drop duplicate C includes
build: drop global suppression of `-Wformat-nonliteral`, fix fallouts
build: drop unused `snprintf()` feature check on Windows
build: fix `-Wunused-macros` warnings, and related tidy-ups
build: fix building rare combinations
build: fully omit verbose strings and code when disabled
build: globally suppress DJGPP warnings in `FD_SET()`
build: merge TrackMemory (`CURLDEBUG`) into debug-enabled option
build: move curl stat struct type to the curlx namespace
build: opt-in MSVC to C99-style verbose logging logic
build: require POSIX `strdup()`
build: tidy up and dedupe `strdup` functions
cf-socket: ignore SOCK_CLOEXEC etc for socktype equality checks
cf-socket: use SOCK_CLOEXEC in socket_open when available
checksrc-all.pl: skip non-repository files
checksrc: do not apply `BANNEDFUNC` to struct member functions
checksrc: warn for leading spaces before the preprocessor hash
clang-tidy: add missing and delete redundant parentheses
clang-tidy: add more missing parentheses in macro values
clang-tidy: avoid/silence `bugprone-not-null-terminated-result`
clang-tidy: check `bugprone-macro-parentheses`, fix fallouts
clang-tidy: drop redundant conditions reported by `misc-redundant-expression`
clang-tidy: enable `bugprone-signed-char-misuse`, fix fallouts
clang-tidy: enable more checks
clang-tidy: enable scanning headers
clang-tidy: fix issues found with build-fuzzing
clang-tidy: silence more minor issues found by v22
cmake/FindMbedTLS: add workaround for missing static MSVC `mbedcrypto.lib` 4.0.0
cmake: add `CURL_DROP_UNUSED` option to reduce binary sizes
cmake: add native clang-tidy support for tests, with concatenated sources
cmake: always build curlu and curltool test libs in unity mode
cmake: always define `CURL::win32_winsock` on Windows in `curl-config.cmake`
cmake: convert `curl_add_clang_tidy_test_target()` macro to function
cmake: enable binutils ld workaround for all toolchains at build-time
cmake: fix `LOCATION` property access condition (debug)
cmake: fix `LOCATION` property read errors in target debug function
cmake: fix building with `CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON`
cmake: fix confusing error when a dependency is undetected in `curl-config.cmake`
cmake: fix logic for openssl/zlib binutils ld workaround
cmake: fix passing system header directories to clang-tidy for tests
cmake: fix system include directory position for clang-tidy in tests
cmake: improve clang-tidy test command-line reproduction
cmake: minor fixes to test targets after prev
cmake: normalize uppercase hex winver (for display)
cmake: omit `curl.rc` from curltool lib
cmake: reference OpenSSL and ZLIB imported targets only when enabled
cmake: replace internal option with a new `tt` (test tools) target
cmake: silence potential unused var warnings in C++ test snippet
cmake: silence silly Apple clang warnings in C89 mode, test in CI
cmake: silence useless compiler warnings triggered by the FASTBuild generator
cmake: skip binutils ld hack if zlib/openssl target is not `IMPORTED`
cmake: warn for invalid `CURL_TARGET_WINDOWS_VERSION` values
cmke: add `*_USE_STATIC_LIBS` options for 9 dependencies
config-plan9: set `HAVE_STDINT_H` again
config2setopts: acknowledge OOM error from CURLOPT_MIMEPOST
config2setopts: fix for --disable-aws build configuration
configure: drop always true `if` check (Windows)
content_encoding: return 'identity' if none other exists
curl: add -I and -i to -h important
curl: limit Windows-specific code to Windows builds, other tidy-ups
curl_easy_nextheader.md: a new transfer invalidates 'prev'
curl_get_line: drop single-use macro
curl_multi_perform.md: resolve inconsistency
curl_ntlm_core: merge two `#if` blocks
curl_setup.h: drop extra header guard for internal include
curl_setup.h: merge back single-use internal header `curl_setup_once.h`
curl_setup.h: simplify curl memory macro mappings
curl_setup_once: allow CURL_DEBUGASSERT for customization
CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md: fix available protocols
curlx: drop unused `curlx_saferealloc()`
digest: escape double quotes and backslashes in realm and nonce
digest: fix memory leak in auth_create_digest_http_message()
digest: handle quotes in the path
docs/INSTALL: update configure details
docs/libcurl: unify WARNING use
docs: add LibreELEC to DISTROS.md
docs: add reproducible example for generating man page
docs: avoid starting sentences with However,
docs: avoid using the word 'magic'
docs: clarify --ipv4 and --ipv6
docs: document the need for a 64-bit type and stdint.h
docs: drop basically
docs: explicitly call out Slowloris as not a security flaw
docs: fix grammar nitpicks
docs: handle error in `curl_global_init*` examples
docs: replace instances of the vague qualifier 'quite'
docs: reword explanation of --variable option
docs: some nitpicks
docs: use dot instead of comma at end of sentences
easy: reset errorbuf on eyeballing success
easy: reset pausing when resetting request
examples/usercertinmem: use modern OpenSSL API, drop mentions of RSA
examples: improve OpenSSL certificate examples
examples: omit forward declarations, apply misc fixes
FAQ: syntax improvements
fopen.h: simplify curl memory macro mappings
ftp: replace a `curlx_free()` with `curlx_dyn_free()`
ftp: split ftp_state_use_port into sub functions
GOVERNANCE.md: Post-Daniel BDFL
gss: exclude verbose error logic from non-verbose builds
h2+h3: align stream close handling
hostip.c: fix leak of addrinfo
hostip6: remove debug-only code
hostip: fix unreachable code in rare build configuration
http/3: add description for known server error codes
http1: fix potential NULL dereference in `Curl_h1_req_parse_read()`
http: only send bearer if auth is allowed
http_aws_sigv4: fix query normalization of %2b
imap: add a check for Curl_meta_get()
imap: check `imap_sendf()` printf masks at compile-time
imap: skip literals inside quoted strings
include: avoid recursive macros
include: mask computed auth/proto bitmasks to 32 bits
INSTALL-CMAKE.md: document Apple framework options
INSTALL.md: fix typo
INSTALL.md: suggest `-Wl,-dead_strip` for Apple targets
KNOWN_BUGS.md: absolute Unix domain filename for SOCKS on Windows
ldap: silence clang-tidy v22 warning
ldap: silence potential unused variable warning (OS400)
lib: delete unused local includes
lib: disable websockets early if no http
lib: make sigpipe handling more lazy
lib: reorder protocol functions to avoid forward declarations (email)
lib: reorder protocol functions to avoid forward declarations (ftp)
lib: reorder protocol functions to avoid forward declarations (misc cont.)
lib: reorder protocol functions to avoid forward declarations (misc)
lib: reorder protocol functions to avoid forward declarations (ssh)
lib: separate scheme info from protocol implementation
lib: skip compiling code with features disabled
lib: use (u)int64_t instead of long long
libcurl docs: reduce 'since ...' in descriptions
libcurl-security.md: fix typos and add a point about URLs
libtests: drop two redundant `memset()`s
Makefile.am: delete RPM targets referencing non-existent files
Makefile.am: drop stray VC project files from dist
managen: silence Perl warnings
mbedtls: guard TLS 1.3 + session tickets usage inside ifdef
mbedtls: no pinnedpubkey wo MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
mbedtls: remove newline from failf() call
mbedtls: split mbed_connect_step1 into sub functions
md4, md5: drop redundant forward declarations
md4, md5: replace custom types with `uint32_t`
memdebug: include `backtrace.h` as system header
mime: drop fallback for unused `R_OK` macro
mimepost: allocate main struct on-demand
mk-ca-bundle.pl: drop support for obsolete/insecure fingerprint algos
mod_curltest: silence unused argument compiler warning
mprintf: drop old sprintf fallback
mprintf: rename internal enum to avoid collision with AmigaOS symbol
mprintf: silence clang-tidy `readability-suspicious-call-argument`
mprintf: use `_snprintf()` when compiled with VS2013 and older
mqtt: better too-big-message-check
mqtt: fix EOF handling
mqtt: verify Remaining Length for CONNACK and PUBACK
msvc: drop exception, make `BIT()` a bitfield with Visual Studio
msvc: VS2026: unlock picky warning in cmake, test in CI
multi: avoid a theoretical 32-bit wrap
multi: fix unreachable code compiler warning
multi: probe for IPv6 functionality in multi_init()
multi: split multi_runsingle into sub functions
multi: update timer unconditionally in multi_remove_handle
ngtcp2: stabilize recv
noproxy: simplify, don't mix const non-const in strchr()
openldap: avoid forward declarations in ldaps code
openssl+ech: workaround for insecure handshakes
openssl: adapt to OpenSSL master adding const to more APIs
OpenSSL: check reuse of sessions for verify status
openssl: disable local keylog feature if built-in upstream
openssl: fix compiler warning with OpenSSL master
openssl: fix potential NULL dereference when loading certs (Windows)
openssl: fix potential OOB read in debug/verbose logging
plan9: drop special build and orphaned references
proxy-auth: additional tests
pytest: remove 03_02
quiche: use PRIu64 for outputting the stream id
rand: drop impossible preprocessor branches (wincrypt)
rand: drop scan-build silencer
ratelimit: download finetune
request.h: rename parameter 'buf' to 'req' in Curl_req_send
REUSE: drop broken reference to `MAIL-ETIQUETTE`
rtsp: fix assertion failure on zero-length RTP payload
rtspd: fix to check `realloc()` result
runtests: pass config filename to stunnel in native format (Windows)
schannel: refactor: reduce variable scopes, fix comment, fix indent
send: drop `CURL_UNCONST()` from buffer argument on most platforms
setopt: fix checking range for CURLOPT_MAXCONNECTS
setopt: refuse blobs with zero length
setup-os400.h: drop no longer used custom type `u_int32_t`
sigpipe: unset SA_SIGINFO since it is using sa_handler
silent.md: also mention it shuts off warning messages
smb: free the path in the request struct properly
smb: include arpa/inet.h for NonStop
socket: check result of SO_NOSIGPIPE
socketpair: clear 'err' when retrying due to EINTR
socketpair: set SO_NOSIGPIPE where possible
socks: ensure DNS is freed in failure cases.
src: simplify declaring `curl_ca_embed`
ssh: dedupe state change function
stop using the word 'just'
sws: prevent "connection monitor" to say disconnect twice
synctime: fix use of uninitialized buffer on non-Windows
system_win32: replace manual init code with `curlx_now_init()` call
tests/server/sockfilt: avoid possible endless loop on Windows
tests/server: drop unused `curlx/version_win32.c`
tests/server: fix to clear the complete `srvr_sockaddr_union_t` variable
tests/server: tidy-up error messages (Windows)
tests: avoid assignment in `if` conditions in `first.h`
tests: convert base64 data to %b64[]
tftp: correct the filename length check
timeout handling: auto-detect effective timeout
tls: add new SSLSUPP flags for several options
tls: remove checks for DEFAULT
tool: enable header separation for HTTPS proxies
tool: improve config error messaging
tool: improve error/warning messages when output filename sanitization fails
tool: rename curl handle and result variable in `--libcurl`-generated code
tool: return code variable consistency
tool_cb_hdr: suppress header output when --out-null
tool_cb_prg: drop duplicate preprocessor logic
tool_dirhie: drop superfluous `F_OK` fallback (Windows)
tool_doswin: avoid memory-leak with CURL_FN_SANITIZE_*
tool_doswin: avoid Windowsisms in socket code (cont.)
tool_doswin: avoid Windowsisms in socket code
tool_doswin: document `ENABLE_VIRTUAL_TERMINAL_PROCESSING` toolchain support
tool_getparam: avoid `-Wcomma` with Apple clang in C89 mode
tool_operate: remove 'else' for VMS
tool_operate: reset the URL --url-query between --next
typos: silence false positives found in C code
unit3205: suppress two clang-tidy false positives
URL-SYNTAX.md: fix port number mistakes for IMAP and LDAP
url.c: code/comment cleanup around conn creation
url.h: fix `-Wdocumentation`
url: fix reuse of connections using HTTP Negotiate
urlapi: use U_CURLU_URLDECODE when toggling it off unsigned
urldata.h: remove two forward-declared structs not used
urldata: byebye `conn->hostname_resolve`
urldata: change 'keep_post' into three distinct bitfields
urldata: convert 'long' fields to fixed variable types
urldata: switch to uint* types
usercertinmem: use the correct cert BIO
verbose.md: explain the { and } prefixes
vquic: fix unused variable warning reported by clang-tidy
vquic: handle SOCKEMSGSIZE correctly
vtls: dedupe common on-session-reuse logic
vtls: use ALPN http/1.0 & http/1.1 for HTTP/1.0 requests
VULN-DISCLOSURE-POLICY.md: push reports to the web form
VULN-DISCLOSURE-POLICY.md: use hackerone
winapi: use FormatMessageA instead of FormatMessageW
windows: `USE_WINSOCK` to guard winsock2 code (where missing)
windows: determine `RtlVerifyVersionInfo` address on global init
windows: tidy up `wincrypt.h` / BoringSSL/AWS-LC coexist workaround
wolfssl: fix build without USE_BIO_CHAIN
ws/tftp: include header file even when protocol disabled
x509asn1: make encodeOID stop on too long input
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit da3d30c4bd37c6e3f3a177676a8d33771d67374e
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon May 4 19:40:57 2026 +0200
glib: Update to version 2.88.1
- Update from version 2.88.0 to 2.88.1
- Update of rootfile
- Changelog
2.88.1
* Fix miscompilation with GCC 16 due to GLib’s use of the wrong function
attribute (!5145, work by Sam James)
* Fix flag confusion security issue when using `GRegex` with `G_REGEX_RAW` which
can result in unbounded out-of-bounds heap reads off the start of a regex
input string (#3919, work by linhlhq)
* Fix various minor (low severity) security issues, typically one-to-five-byte
out-of-bounds reads (#3915, #3916, #3917, #3918, #3930) or ones relying on
very specific (and unlikely) API calls (#3925) or ones relying on
discouraged P2P D-Bus configurations (#3931, #3933) (work by linhlhq)
* Bugs fixed:
- #3915 (#YWH-PGM9867-190) Buffer Over-read on GLib through glib/gvariant-
serialiser.c:1253 via gvs_tuple_is_normal() (Philip Withnall)
- #3916 (#YWH-PGM9867-187) OOB Read on GLib through
glib/gmarkup.c:g_markup_escape_text() via
glib/gmarkup.c:append_escaped_text() (Philip Withnall)
- #3917 (#YWH-PGM9867-191) OOB Read on GLib through
glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime` (Philip
Withnall)
- #3918 (#YWH-PGM9867-193) Buffer Over-read on GLib's g_regex_replace()
through glib/gregex.c:string_append() via g_utf8_next_char() (Philip
Withnall)
- #3919 (#YWH-PGM9867-194) Buffer Over-read on GLib through
glib/gregex.c:g_regex_split_full() via glib/gutf8.c:g_utf8_prev_char()
(Philip Withnall)
- #3925 (#YWH-PGM9867-199) Buffer Over-read on GLib through glib/giochannel.c
via "g_io_channel_read_line_backend" (Philip Withnall)
- #3930 (#YWH-PGM9867-200) Off-by-one Error on GLib through glib/gkeyfile.c
via "g_key_file_get_locale_string_list" (Philip Withnall)
- #3931 (#YWH-PGM9867-203) Path Traversal on GLib DBus through
glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry,
mechanism_client_data_receive (COOKIE_SHA1 Client Authentication) leads to
Arbitrary File Read (Philip Withnall)
- #3933 Integer overflow in g_dbus_message_bytes_needed() bypasses 128 MiB
size check (pre-auth DoS on P2P connections) (Philip Withnall)
- !5101 Update Serbian translation
- !5105 docs: Expand docs for GLIB_VERSION_MAX_ALLOWED
- !5110 gmarkup: fix type of length parameter of text_validate()
- !5111 Update Russian translation
- !5113 Update Polish translation
- !5114 docs: Remove myself from CODEOWNERS
- !5122 Update Slovak translation
- !5134 Backport various recent security fixes to GVariant, GMarkup, GDateTime
and GRegex to glib-2-88
- !5150 Backport !5145 “gvarianttype: use pure attribute, not inappropriate
const” to glib-2-88
- !5152 Update Slovak translation
- !5154 Update German translation
- !5165 Update Slovak translation
- !5166 Update Slovak translation
- !5169 Update Persian translation
- !5174 Backport !5170 !5171 !5172 !5173 Various security fixes to glib-2-88
* Translation updates:
- German (Christian Kirbach)
- Persian (Danial Behzadi)
- Polish (Victoria Niedzielska)
- Russian (Artur S0)
- Serbian (Марко Костић)
- Slovak (Jose Riha)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 584e8f3cce0c6a612788e38aa56757bfc8f11a8d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon May 4 19:40:58 2026 +0200
gnutls: Update to version 3.8.13
- Update from version 3.8.11 to 3.8.13
- Update of rootfile
- 13 CVE Fixes in 3.8.13
- 2 CVE Fixes in 3.8.12
- Changelog
3.8.13
** libgnutls: Add more checks to DTLS reassembly
Previously, gnutls didn't check that DTLS fragments claimed
a consistent message_length value.
Additionally, a crucial array size check was missing,
enabling an attacker to cause a heap overwrite.
Reject fragments with mismatching length and add a missing boundary check.
Independently reported by
Haruto Kimura (Stella), Oscar Reparaz and Zou Dikai.
[GNUTLS-SA-2026-04-29-1, CVSS: high] [CVE-2026-33846]
** libgnutls: Fix qsort comparator in DTLS reassembly
The comparator function used for ordering DTLS packets
by sequence numbers did not follow qsort comparator contracts
in case of packets with duplicate sequence numbers,
which could lead to unstable ordering or undefined behaviour.
Return 0 in such cases makes the sorting stable.
Additionally, discard packets with same sequence numbers
and differing handshake type,
so that they don't end up being sorted in the first place.
Reported by Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-2, CVSS: high] [CVE-2026-42009]
** libgnutls: Fix crashing on an underflow with a DTLS datagram
A remotely triggerable underflow in the DTLS reassembly code led to
a heap overrun.
Prevent the underflow from happening.
Reported by Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-3, CVSS: high] [CVE-2026-33845]
** libgnutls: Fix RSA-PSK identity truncation
Servers configured with RSA-PSK have wrongfully matched usernames with NUL
character in them to ones truncated to NUL character,
which could lead to an authentication bypass.
Fix the check to perform comparison up to the full username length.
Reported by Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-4, CVSS: high] [CVE-2026-42010]
** libgnutls: Fix case-sensitivity of domain name comparison in name constraints
Domain name comparison during name constraints processing
was case-sensitive, violating RFC 5280 section 7.2.
For excluded name constraints, this could lead to
incorrectly accepting domain names that should've been rejected.
DNS name comparison and the domain part of email names
now perform case-insensitive comparison.
Independently reported by Oleh Konko (1seal) and
Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-5, CVSS: high] [CVE-2026-3833]
** libgnutls: Fix intersecting empty constraints
Permitted name constraints were wrongfully ignored
when prior CAs only had excluded name constraints,
resulting in a name constraint bypass.
Reported by Haruto Kimura (Stella).
[GNUTLS-SA-2026-04-29-6, CVSS: medium] [CVE-2026-42011]
** libgnutls: Suppress CN fallback in presence of URI and SRV SAN
Certificates containing URI or SRV Subject Alternative Names
no longer fall back to checking DNS hostnames against Common Name
to avoid potential misuse of such certificates
beyond their original purpose.
Reported by Oleh Konko (1seal).
[GNUTLS-SA-2026-04-27-7, CVSS: medium] [CVE-2026-42012]
** libgnutls: Suppress CN fallback for oversized SAN
Validation of certificates with oversized Subject Alternative Names
no longer falls back to checking DNS hostnames against Common Name.
Independently reported by Haruto Kimura (Stella) and
Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-27-8, CVSS: medium] [CVE-2026-42013]
** libgnutls: Fix use-after-free in gnutls_pkcs11_token_set_pin
Changing the Security Officer PIN with gnutls_pkcs11_token_set_pin()
with oldpin == NULL for a token lacking a protected authentication path
led to a use-after-free.
Reported by Luigino Camastra and Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-9, CVSS: medium] [CVE-2026-42014]
** libgnutls: Fix overread in RSA key exchange with PKCS#11 keys
For a server using an RSA key backed by a PKCS#11 token,
a client sending an extremely short premaster secret
during an RSA key exchange could trigger a short heap overread.
Reported by Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-10, CVSS: medium] [CVE-2026-5260]
** libgnutls: Fix off-by-one in PKCS#12 bag element bounds check
Appending to a PKCS#12 bag that already contained 32 elements
could write past the bag's internal array.
Reported by Zou Dikai.
[GNUTLS-SA-2026-04-29-11, CVSS: low] [CVE-2026-42015]
** libgnutls: Fix multi-entry OCSP response revocation bypass
When validating a certificate against a multi-entry OCSP response,
the revocation status was always checked for the first entry
instead of the entry matching the certificate,
which could lead to accepting revoked certificates.
Independently reported by Oleh Konko (1seal) and
Joshua Rogers of AISLE Research Team.
[GNUTLS-SA-2026-04-29-12, CVSS: low] [CVE-2026-3832]
** libgnutls: Fix timing side-channel in PKCS#7 padding removal
The PKCS#7 padding check performed during decryption was not constant-time,
potentially leaking information about the padding bytes
through timing differences.
Rewritten to remove padding in a branch-free manner.
Reported by Doria Tang of Stony Brook University.
[GNUTLS-SA-2026-04-29-13, CVSS: low] [CVE-2026-5419]
** libgnutls: Fix PSK username comparison during rehandshake
Rehandshaking to a username with embedded NUL character could theoretically
allow bypassing the GNUTLS_ALLOW_ID_CHANGE protection (#1808).
Reported and fixed by Joshua Rogers of AISLE Research Team.
** libgnutls: Fix OID length check for OCSP delegated signer EKU
The OCSP signing EKU OID was compared without verifying its length,
allowing a shorter OID that shares the same prefix to match.
The check now verifies the length as well (#1810).
Reported by Joshua Rogers of AISLE Research Team.
** libgnutls: Fix AES keys persisting with pkcs11-provider
When using the pkcs11-provider, AES keys used for cipher operations
were created as persistent objects and accumulating.
They are now ephemeral (#1813).
** libgnutls: Fix missing RSA key coprimality check in verify_params
gnutls_privkey_verify_params overlooked the scenario of p and q
not being co-prime.
It now returns GNUTLS_E_PK_INVALID_PRIVKEY in this case (#1818).
Reported by Kamil Frankowicz.
** libgnutls: Fix overread when parsing OpenSSL PEM private keys
Insufficient bounds checking on the PEM header length could lead
to short heap overreads on specially crafted inputs (#1854).
Independently reported by Kamil Frankowicz and
Joshua Rogers of AISLE Research Team.
** libgnutls: Fix a theoretical double-free during certificate import
If gnutls_x509_crt_list_import_pkcs11 failed partway through,
the trust list cleanup code would try to free already-deinitialized
certificate entries, leading to a double-free (#1819).
Reported by Joshua Rogers of AISLE Research Team.
** libgnutls: Fix heap overread in SCT extension parser
The list-length validation didn't account for the 2-byte length field,
allowing a specially crafted SCT extension to cause
a 2-byte overread past the buffer (#1822).
Reported by Joshua Rogers of AISLE Research Team.
** libgnutls: Zeroize shared secret derived during hybrid key exchange
The derived shared secret was not zeroized before being freed (#1841).
Reported by liyue.
** build: Support building with Nettle 4.0
Nettle 4.0 was released in Feburary 2026, with API incompatibile
changes from 3.10. The library can now compile with it, while
Nettle 3.10 is still supported (#1791).
** libgnutls: Support deriving ML-DSA public key from an expanded private key
RFC 9881 defines 3 private key formats for ML-DSA: "seed",
"expandedKey" and both. It is now possible to derive a public key
from a private key in the "expandedKey" format (#1723).
** libgnutls: Fix loading BIT STRING encoded EdDSA key from PKCS#11
For compatibility reasons, the library supports two formats for
EdDSA private keys: either ASN.1 BIT STRING (raw) or OCTET STRING
(DER). Previously, loading a private key in the former format
resulted in a failure, which is now fixed (#1749).
** libgnutls: HPKE (RFC 9180) is now supported as a technology preview
The Hybrid Public Key Encryption (HPKE) is a flexible cryptographic
protocol which enables to encrypt arbitrary data to a recipient, by
combining key encapsulation mechanism (KEM) and authenticated
encryption with additional data (AEAD). GnuTLS now includes the
implementation contributed by David Dudas. Given this is a
technology preview, the implementation and the API might suffer
modification in the following period. Use --enable-hpke to turn on
this feature (#1506).
** libgnutls: Fix TLS 1.3 client certificate selection
For servers that send a signature_algorithms extension in CertificateRequest
with new rsa_pss_rsae_* algorithms and without the legacy rsa_pkcs1_* ones,
the client now properly considers RSA when selecting a certificate to send.
This fixes TLS 1.3 interoperability with newer Java servers
when using client certificates.
Contributed by Romain Tartière (#1842).
** libgnutls: Fix kTLS ChaCha20-Poly1305 IV for TLS 1.2
When using kTLS with ChaCha20-Poly1305 under TLS 1.2,
an incorrect value was passed as the IV to the kernel,
causing connections to fail early.
** libgnutls: Allow fetching object type metadata for PKCS#11 keys
A new library function, gnutls_pkcs11_obj_get_pk_algorithm,
has been added to check the public key algorithms of PKCS#11 key objects.
Object types other than CKO_PRIVATE_KEY are currently not supported.
Contributed by Ghadi Elie Rahme (!2074).
** API and ABI modifications:
gnutls_hpke_kem_t: New enum
gnutls_hpke_kdf_t: New enum
gnutls_hpke_aead_t: New enum
gnutls_hpke_mode_t: New enum
gnutls_hpke_role_t: New enum
gnutls_hpke_context_st: New context structure
gnutls_hpke_init: New function
gnutls_hpke_deinit: New function
gnutls_hpke_encap: New function
gnutls_hpke_seal: New function
gnutls_hpke_decap: New function
gnutls_hpke_open: New function
gnutls_hpke_derive_keypair: New function
gnutls_hpke_export: New function
gnutls_pkcs11_obj_get_pk_algorithm: New function
3.8.12
** libgnutls: Fix NULL pointer dereference in PSK binder verification
A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello
could lead to a denial of service attack via crashing the server.
The updated code guards against the problematic dereference.
Reported by Jaehun Lee.
[Fixes: GNUTLS-SA-2026-02-09-1, CVSS: high] [CVE-2026-1584]
** libgnutls: Fix name constraint processing performance issue
Verifying certificates with pathological amounts of name constraints
could lead to a denial of service attack via resource exhaustion.
Reworked processing algorithms exhibit better performance characteristics.
Reported by Tim Scheckenbach.
[Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]
** libgnutls: Fix multiple unexploitable overflows
Reported by Tim Rühsen (#1783, #1786).
** libgnutls: Fall back to thread-unsafe module initialization
Improve fallback handling for PKCS#11 modules that
don't support thread-safe initialization (#1774).
Also return filename from p11_kit_module_get_name() for unconfigured modules.
** libgnutls: Accept NULL as digest argument for gnutls_hash_output
The accelerated implementation of gnutls_hash_output() now
properly accepts NULL as the digest argument, matching the
behavior of the reference implementation (#1769).
** srptool: Avoid a stack buffer overflow when processing large SRP groups.
Reported and fixed by Mikhail Dmitrichenko (#1777).
** API and ABI modifications:
No changes since last version.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 297697787d06c49c8e44240402e017002cf6ea69
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon May 4 19:40:59 2026 +0200
libmicrohttpd: Update to version 1.0.5
- Update from version 1.0.3 to 1.0.5
- No change to rootfile
- Changelog
1.0.5
It fixes a additional HTTP request smuggling issues (CWE-444)
1.0.4
It fixes a minor HTTP request smuggling issue (CWE-444).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9f9df41296504060922a32d55a6c15eb4a7f1e87
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Mon May 4 22:05:52 2026 +0200
apache: Update to 2.4.67
For details see:
https://dlcdn.apache.org/httpd/CHANGES_2.4.67
"Changes with Apache 2.4.67
*) SECURITY: CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp:
Heap Over-Read and memory disclosure in ajp_parse_data()
(cve.mitre.org)
Buffer Over-read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp:
Heap Buffer Over-Read Due to Missing Null-Termination Check
(ajp_msg_get_string) (cve.mitre.org)
Improper Null Termination, Out-of-bounds Read vulnerability in
Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Tianshuo Han (<hantianshuo233@gmail.com>)
*) SECURITY: CVE-2026-33857: Apache HTTP Server: Off-by-one OOB
reads in AJP getter functions (cve.mitre.org)
Out-of-bounds Read vulnerability in mod_proxy_ajp of
Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-33523: Apache HTTP Server: multiple modules:
HTTP response splitting forwarding malicious status line
(cve.mitre.org)
HTTP response splitting vulnerability in multiple Apache HTTP
Server modules with untrusted or compromised backend servers.
This issue affects Apache HTTP Server: from through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Haruki Oyama (Waseda University)
*) SECURITY: CVE-2026-33007: Apache HTTP Server: mod_authn_socache
crash (cve.mitre.org)
A NULL pointer dereference in the mod_authn_socache in Apache
HTTP Server 2.4.66 and earlier allows an unauthenticated remote
user to crash a child process in a caching forward proxy
configuration.
Users are recommended to upgrade to version 2.4.67, which fixes
this issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-33006: Apache HTTP Server: mod_auth_digest
timing attack (cve.mitre.org)
A timing attack against mod_auth_digest in Apache HTTP Server
2.4.66 allows a bypass of Digest authentication by a remote
attacker.
Users are recommended to upgrade to version 2.4.67, which fixes
this issue.
Credits: Nitescu Lucian
*) SECURITY: CVE-2026-29169: Apache HTTP Server: mod_dav_lock
indirect lock crash (cve.mitre.org)
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server
2.4.66 and earlier may allow an attacker to crash the server
with a malicious request.mod_dav_lock is not used internally by
mod_dav or mod_dav_fs.
The only known use-case for mod_dav_lock was mod_dav_svn from
Apache Subversion earlier than version 1.2.0.
Users are recommended to upgrade to version 2.4.66, which fixes
this issue, or remove mod_dav_lock.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-29168: Apache HTTP Server: mod_md
unrestricted OCSP response (cve.mitre.org)
Allocation of Resources Without Limits or Throttling
vulnerability in Apache HTTP Server's mod_md via OCSP response
data.
This issue affects Apache HTTP Server: from 2.4.30 through
2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-28780: Apache HTTP Server: buffer overflow in
mod_proxy_ajp via ajp_msg_check_header() (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of
Apache HTTP Server.
If mod_proxy_ajp connects to a malicious AJP server this AJP
server can send a malicious AJP message back to mod_proxy_ajp
and cause it to write 4 attacker controlled bytes after the end
of a heap based buffer.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Andrew Lacambra
*) SECURITY: CVE-2026-24072: Apache HTTP Server: mod_rewrite
elevation of privileges via ap_expr (cve.mitre.org)
An escalation of privilege bug in various modules in Apache HTTP
2.4.66 and earlier allows local .htaccess authors to read files
with the privileges of the httpd user.
Users are recommended to upgrade to version 2.4.67, which fixes
this issue.
Credits: y7syeu
*) SECURITY: CVE-2026-23918: Apache HTTP Server: http2: double free
and possible RCE on early reset (cve.mitre.org)
Double Free and possible RCE vulnerability in Apache HTTP Server
with the HTTP/2 protocol.
This issue affects Apache HTTP Server: 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes
the issue.
Credits: Bartlomiej Dmitruk, striga.ai
*) mod_md: update to version 2.6.10
- Fix issue #420 <https://github.com/icing/mod_md/issues/420> by ignoring
job.json files that claim to have completely finished a certificate
renewal, but have not produced the necessary result files.
*) mod_http2: update to version 2.0.39
Remove streams own memory allocator after reports of memory problems
with third party modules.
[Stefan Eissing]
*) mod_http2: update to version 2.0.38
Source sync with mod_h2 github repository. No functional change.
[Stefan Eissing]
*) Updated conf/mime.types: added vnd.sqlite3, HEIC, HEIF
[Alexandru Mărășteanu <hello alexei.ro>]
*) mod_md: update to version 2.6.7
- Fix a regression in `MDStapleOthers` which broke in v2.6.0 and no longer
applied, no matter the configuration.
*) mod_md: update to version 2.6.9
- Pebble 2.9+ reports another error when terms of service agreement is
not set. Treating all "userActionRequired" errors as permanent now.
*) mod_md: update to version 2.6.8
- Fix the ARI related `replaces` property in ACME order creation to only
be used when the CA supports ARI and it is enabled in the menu config.
- Fix compatibility with APR versions before 1.6.0 which do not have
`apr_cstr_casecmp` and should use `apr_strnatcasecmp` instead.
*) mod_http2: update to version 2.0.37
Prevent double purge of a stream, resulting in a double free.
Fixes PR 69899.
[Stefan Eissing]
*) mod_md: Use correct function name when compiling against APR < 1.6.0.
PR 69954 [Tần Quảng <baobaoxich@gmail.com>]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/apache2 | 6 ++----
config/rootfiles/common/curl | 3 +++
config/rootfiles/common/glib | 16 ++++++++--------
config/rootfiles/common/gnutls | 12 +++++++++++-
.../{oldcore/114 => core/202}/filelists/apache2 | 0
config/rootfiles/core/202/update.sh | 1 +
lfs/apache2 | 6 +++---
lfs/curl | 4 ++--
lfs/glib | 4 ++--
lfs/gnutls | 13 ++++++-------
lfs/libmicrohttpd | 6 +++---
11 files changed, 41 insertions(+), 30 deletions(-)
copy config/rootfiles/{oldcore/114 => core/202}/filelists/apache2 (100%)
Difference in files:
diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2
index 8bca87c3b..2f31ba756 100644
--- a/config/rootfiles/common/apache2
+++ b/config/rootfiles/common/apache2
@@ -371,6 +371,8 @@ srv/web/ipfire/html/captive
#srv/web/ipfire/manual/developer/index.html
#srv/web/ipfire/manual/developer/index.html.en
#srv/web/ipfire/manual/developer/index.html.zh-cn.utf8
+#srv/web/ipfire/manual/developer/mod_example_1.c
+#srv/web/ipfire/manual/developer/mod_example_2.c
#srv/web/ipfire/manual/developer/modguide.html
#srv/web/ipfire/manual/developer/modguide.html.en
#srv/web/ipfire/manual/developer/modules.html
@@ -1201,10 +1203,6 @@ srv/web/ipfire/html/captive
#srv/web/ipfire/manual/platform/netware.html.en
#srv/web/ipfire/manual/platform/netware.html.fr.utf8
#srv/web/ipfire/manual/platform/netware.html.ko.euc-kr
-#srv/web/ipfire/manual/platform/perf-hp.html
-#srv/web/ipfire/manual/platform/perf-hp.html.en
-#srv/web/ipfire/manual/platform/perf-hp.html.fr.utf8
-#srv/web/ipfire/manual/platform/perf-hp.html.ko.euc-kr
#srv/web/ipfire/manual/platform/rpm.html
#srv/web/ipfire/manual/platform/rpm.html.en
#srv/web/ipfire/manual/platform/rpm.html.fr.utf8
diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl
index 9eb01f389..96daee9e6 100644
--- a/config/rootfiles/common/curl
+++ b/config/rootfiles/common/curl
@@ -82,6 +82,7 @@ usr/lib/libcurl.so.4.8.0
#usr/share/man/man3/CURLINFO_RTSP_SERVER_CSEQ.3
#usr/share/man/man3/CURLINFO_RTSP_SESSION_ID.3
#usr/share/man/man3/CURLINFO_SCHEME.3
+#usr/share/man/man3/CURLINFO_SIZE_DELIVERED.3
#usr/share/man/man3/CURLINFO_SIZE_DOWNLOAD.3
#usr/share/man/man3/CURLINFO_SIZE_DOWNLOAD_T.3
#usr/share/man/man3/CURLINFO_SIZE_UPLOAD.3
@@ -120,6 +121,8 @@ usr/lib/libcurl.so.4.8.0
#usr/share/man/man3/CURLMOPT_PIPELINING_SITE_BL.3
#usr/share/man/man3/CURLMOPT_PUSHDATA.3
#usr/share/man/man3/CURLMOPT_PUSHFUNCTION.3
+#usr/share/man/man3/CURLMOPT_QUICK_EXIT.3
+#usr/share/man/man3/CURLMOPT_RESOLVE_THREADS_MAX.3
#usr/share/man/man3/CURLMOPT_SOCKETDATA.3
#usr/share/man/man3/CURLMOPT_SOCKETFUNCTION.3
#usr/share/man/man3/CURLMOPT_TIMERDATA.3
diff --git a/config/rootfiles/common/glib b/config/rootfiles/common/glib
index cd96e6f7a..f9e0ca72a 100644
--- a/config/rootfiles/common/glib
+++ b/config/rootfiles/common/glib
@@ -339,22 +339,22 @@ usr/include/glib-2.0/gio/gdebugcontroller.h
#usr/lib/glib-2.0/include/glibconfig.h
#usr/lib/libgio-2.0.so
usr/lib/libgio-2.0.so.0
-usr/lib/libgio-2.0.so.0.8800.0
+usr/lib/libgio-2.0.so.0.8800.1
#usr/lib/libgirepository-2.0.so
usr/lib/libgirepository-2.0.so.0
-usr/lib/libgirepository-2.0.so.0.8800.0
+usr/lib/libgirepository-2.0.so.0.8800.1
#usr/lib/libglib-2.0.so
usr/lib/libglib-2.0.so.0
-usr/lib/libglib-2.0.so.0.8800.0
+usr/lib/libglib-2.0.so.0.8800.1
#usr/lib/libgmodule-2.0.so
usr/lib/libgmodule-2.0.so.0
-usr/lib/libgmodule-2.0.so.0.8800.0
+usr/lib/libgmodule-2.0.so.0.8800.1
#usr/lib/libgobject-2.0.so
usr/lib/libgobject-2.0.so.0
-usr/lib/libgobject-2.0.so.0.8800.0
+usr/lib/libgobject-2.0.so.0.8800.1
#usr/lib/libgthread-2.0.so
usr/lib/libgthread-2.0.so.0
-usr/lib/libgthread-2.0.so.0.8800.0
+usr/lib/libgthread-2.0.so.0.8800.1
#usr/lib/pkgconfig/gio-2.0.pc
#usr/lib/pkgconfig/gio-unix-2.0.pc
#usr/lib/pkgconfig/girepository-2.0.pc
@@ -377,8 +377,8 @@ usr/lib/libgthread-2.0.so.0.8800.0
#usr/share/gdb/auto-load
#usr/share/gdb/auto-load/usr
#usr/share/gdb/auto-load/usr/lib
-#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.0-gdb.py
-#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.0-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.8800.1-gdb.py
+#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.8800.1-gdb.py
#usr/share/gettext/its
#usr/share/gettext/its/gschema.its
#usr/share/gettext/its/gschema.loc
diff --git a/config/rootfiles/common/gnutls b/config/rootfiles/common/gnutls
index 52c3b6764..c02780dfb 100644
--- a/config/rootfiles/common/gnutls
+++ b/config/rootfiles/common/gnutls
@@ -13,6 +13,7 @@ usr/bin/psktool
#usr/include/gnutls/dtls.h
#usr/include/gnutls/gnutls.h
#usr/include/gnutls/gnutlsxx.h
+#usr/include/gnutls/hpke.h
#usr/include/gnutls/ocsp.h
#usr/include/gnutls/openpgp.h
#usr/include/gnutls/pkcs11.h
@@ -32,7 +33,7 @@ usr/lib/libgnutls-dane.so.0.4.1
#usr/lib/libgnutls.la
#usr/lib/libgnutls.so
usr/lib/libgnutls.so.30
-usr/lib/libgnutls.so.30.41.0
+usr/lib/libgnutls.so.30.42.0
#usr/lib/libgnutlsxx.la
#usr/lib/libgnutlsxx.so
usr/lib/libgnutlsxx.so.30
@@ -395,6 +396,14 @@ usr/lib/libgnutlsxx.so.30.0.0
#usr/share/man/man3/gnutls_hmac_init.3
#usr/share/man/man3/gnutls_hmac_output.3
#usr/share/man/man3/gnutls_hmac_set_nonce.3
+#usr/share/man/man3/gnutls_hpke_decap.3
+#usr/share/man/man3/gnutls_hpke_deinit.3
+#usr/share/man/man3/gnutls_hpke_derive_keypair.3
+#usr/share/man/man3/gnutls_hpke_encap.3
+#usr/share/man/man3/gnutls_hpke_export.3
+#usr/share/man/man3/gnutls_hpke_init.3
+#usr/share/man/man3/gnutls_hpke_open.3
+#usr/share/man/man3/gnutls_hpke_seal.3
#usr/share/man/man3/gnutls_idna_map.3
#usr/share/man/man3/gnutls_idna_reverse_map.3
#usr/share/man/man3/gnutls_init.3
@@ -514,6 +523,7 @@ usr/lib/libgnutlsxx.so.30.0.0
#usr/share/man/man3/gnutls_pkcs11_obj_get_exts.3
#usr/share/man/man3/gnutls_pkcs11_obj_get_flags.3
#usr/share/man/man3/gnutls_pkcs11_obj_get_info.3
+#usr/share/man/man3/gnutls_pkcs11_obj_get_pk_algorithm.3
#usr/share/man/man3/gnutls_pkcs11_obj_get_ptr.3
#usr/share/man/man3/gnutls_pkcs11_obj_get_type.3
#usr/share/man/man3/gnutls_pkcs11_obj_import_url.3
diff --git a/config/rootfiles/core/202/filelists/apache2 b/config/rootfiles/core/202/filelists/apache2
new file mode 120000
index 000000000..eef95efa7
--- /dev/null
+++ b/config/rootfiles/core/202/filelists/apache2
@@ -0,0 +1 @@
+../../../common/apache2
\ No newline at end of file
diff --git a/config/rootfiles/core/202/update.sh b/config/rootfiles/core/202/update.sh
index beeaa8c13..6c3a326d0 100644
--- a/config/rootfiles/core/202/update.sh
+++ b/config/rootfiles/core/202/update.sh
@@ -97,6 +97,7 @@ sudo -u nobody /srv/web/ipfire/cgi-bin/ovpnmain.cgi
/etc/init.d/suricata restart
/etc/init.d/unbound restart
/etc/init.d/sshd restart
+/etc/init.d/apache restart
# Restart IPsec
if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then
diff --git a/lfs/apache2 b/lfs/apache2
index 059d011c8..a0c8bcaaa 100644
--- a/lfs/apache2
+++ b/lfs/apache2
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -25,7 +25,7 @@
include Config
-VER = 2.4.66
+VER = 2.4.67
THISAPP = httpd-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 3e702c9eda81440733516b6fe26f44cd358c385203de5a674f65e3806b0204bae4eb845e3a9ab340b2d731f98c9a0e72f616dd3ad070421b31e7814bbfcd6469
+$(DL_FILE)_BLAKE2 = c7f389588b8081080bf81b2f2ffcc585742811a5c7ddc3b63838bb8aad61586e7b8e8854cdb20b56963cc70a952124849b499a7affbf2bad44162f236bb5fbed
install : $(TARGET)
diff --git a/lfs/curl b/lfs/curl
index 3498e12fd..3e5b78ecc 100644
--- a/lfs/curl
+++ b/lfs/curl
@@ -24,7 +24,7 @@
include Config
-VER = 8.19.0
+VER = 8.20.0
THISAPP = curl-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = d4a943af9a109893112876784dbe106276317e6cd5a2663f4de143c93abb4e266945fa65b4a5fa842f99240c961b027a1b2492e3e32f5247a91c394895e2b8b0
+$(DL_FILE)_BLAKE2 = 5b61a1099212af9b3c18629fd0b6c93881014e7b02ed5171021a2a074a87786ff8f8e94a47c53c3ca83354cfbe74f7d917cae819c97011c0ff9e4ace014e01c2
install : $(TARGET)
diff --git a/lfs/glib b/lfs/glib
index 1b6e2269f..47fe1eb6b 100644
--- a/lfs/glib
+++ b/lfs/glib
@@ -24,7 +24,7 @@
include Config
-VER = 2.88.0
+VER = 2.88.1
# https://download.gnome.org/sources/glib/
THISAPP = glib-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = b540e0f5490f85b44cfad5d819f4a6fd911addc26fed8b8b49852bd6ec322d7d16136b691452030cf5f590374ea06cf8fdb8c9109d5cbe7b68625379bbd40615
+$(DL_FILE)_BLAKE2 = d9a0e54d2c1b5128aee76f1743cbeea84a24af5a2252ba1c649943bbca3fbc5f08896249542526560c92dd0e60cbd8a72498c3cfe1535d1f0bf85316ce37dba1
install : $(TARGET)
diff --git a/lfs/gnutls b/lfs/gnutls
index c869100ba..ac2afb361 100644
--- a/lfs/gnutls
+++ b/lfs/gnutls
@@ -24,7 +24,7 @@
include Config
-VER = 3.8.11
+VER = 3.8.13
THISAPP = gnutls-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 54ec3fb396187294ae59c65fa92a515175d8ab19d9f5656569b372b5764b3090724aaa8cedd9467b530f2c74e86a6bfd956d3bd9439a7b69656dcc24e303cbe6
+$(DL_FILE)_BLAKE2 = 80677a45a7c6f892287020e3e6b0add2432f2c64a4c9a649ce889921ac65b44931504ad0682ccc12e4b6d8f94c1a72e35c50673c9d04bd4e327063b812339380
install : $(TARGET)
@@ -70,11 +70,10 @@ $(subst %,%_BLAKE2,$(objects)) :
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && \
- ./configure \
- --prefix=/usr \
- --without-p11-kit \
- --disable-openssl-compatibility
+ cd $(DIR_APP) && ./configure \
+ --prefix=/usr \
+ --without-p11-kit \
+ --disable-openssl-compatibility
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
@rm -rf $(DIR_APP)
diff --git a/lfs/libmicrohttpd b/lfs/libmicrohttpd
index 1cfc60fc7..2ec042d9a 100644
--- a/lfs/libmicrohttpd
+++ b/lfs/libmicrohttpd
@@ -26,7 +26,7 @@ include Config
SUMMARY = Small C library to easily run an HTTP server as part of an application
-VER = 1.0.3
+VER = 1.0.5
THISAPP = libmicrohttpd-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = libmicrohttpd
-PAK_VER = 2
+PAK_VER = 3
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = a739b5b954b94644e586e0323d6da5e6313eefb87a9f85230ed776a92176bae6393f0bf2fd2a45070989b0b193b63017f9c9e76b8409fb5632e4d1f6c6e6b8b1
+$(DL_FILE)_BLAKE2 = dd6ea96a4ab94925d041ef4c45066bf8fb5568c93a727e93295d69db5432ef498d72138f1c64fe157327aca8f97636c9140757c1c048e589d91fddc8ff83a119
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-05-05 9:48 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-05-05 9:48 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 60c49e56542d40a4ec985adab033f12d7e804957 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox