Back to Changelog
Apache
v2.4.69.3
Apache rebuilt with APR-util 1.6.5 and the security updates of six bundled libraries
Improvement
1- Apache itself is unchanged at 2.4.69 and all 94 modules load as before. The package was checked on all nine supported operating systems, and apply, rollback and re-apply were tested on a server with live sites.
Security Fixes
2- APR-util is updated from 1.6.3 to 1.6.5. Version 1.6.4 fixed a heap buffer overflow in the memcached client (CVE-2026-34502), a heap buffer overflow in the Redis client (CVE-2026-34501), a stack recursion crash when parsing XML from an untrusted source (CVE-2026-32327) and a timing weakness in password validation (CVE-2025-49506).
- The package was rebuilt in an updated build image, so the curl, libevent, xz, nghttp2 and PCRE2 libraries it carries now hold their vendor security fixes. These copies are the ones Apache loads; they are the same files the current PHP packages carry.