!221 fix CVE-2024-40725

From: @protkhn Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12
fix CVE-2024-40725
2024-10-16 06:57:56 +00:00 · 2024-10-15 09:27:40 +08:00 · 2024-07-09 07:04:32 +00:00 · 2024-07-09 09:55:24 +08:00 · 2024-05-07 03:30:30 +00:00 · 2024-05-07 11:03:25 +08:00
21 changed files with 4798 additions and 1 deletions
--- a/backport-Add-readbuffsize-api.patch
+++ b/backport-Add-readbuffsize-api.patch
@ -0,0 +1,254 @@
+From ed8996d9a0e503031ef70915ee0f067a71b20a16 Mon Sep 17 00:00:00 2001
+From: ylavic <ylavic@apache.org>
+Date: Mon, 16 Jul 2018 08:49:45 PM GMT+0800
+Subject: [PATCH] Add readbuffsize api
+
+Reference:https://github.com/apache/httpd/commit/ed8996d9a0e503031ef70915ee0f067a71b20a16
+
+---
+ include/ap_mmn.h    |   5 +-
+ include/http_core.h |  12 +++++
+ server/core.c       | 109 +++++++++++++++++++++++++++++++++++++++++---
+ 3 files changed, 118 insertions(+), 8 deletions(-)
+
+diff --git a/include/ap_mmn.h b/include/ap_mmn.h
+index 549c869..2d87cb6 100644
+--- a/include/ap_mmn.h
+++ b/include/ap_mmn.h
+@@ -537,6 +537,9 @@
+  * 20120211.93 (2.4.47-dev) Add proxy_tunnel_rec, ap_proxy_tunnel_create()
+  *                          and ap_proxy_tunnel_run() to proxy_util.
+  * 20120211.93 (2.4.47-dev) Add ap_proxy_worker_can_upgrade()
+ * 20120211.94 (2.4.47-dev) Add read_buf_size member to core_dir_config,
+ *                          flush_max_threshold and flush_max_pipelined to
+ *                          core_server_config, and ap_get_read_buf_size().
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+@@ -544,7 +547,7 @@
+ #ifndef MODULE_MAGIC_NUMBER_MAJOR
+ #define MODULE_MAGIC_NUMBER_MAJOR 20120211
+ #endif
+-#define MODULE_MAGIC_NUMBER_MINOR 93                  /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 94                  /* 0...n */
+ 
+ /**
+  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
+diff --git a/include/http_core.h b/include/http_core.h
+index 8e10988..1172ea3 100644
+--- a/include/http_core.h
+++ b/include/http_core.h
+@@ -253,6 +253,13 @@ AP_DECLARE(const char *) ap_get_server_name_for_url(request_rec *r);
+  */
+ AP_DECLARE(apr_port_t) ap_get_server_port(const request_rec *r);
+ 
+/**
+ * Get the size of read buffers
+ * @param r The current request
+ * @return The read buffers size
+ */
+AP_DECLARE(apr_size_t) ap_get_read_buf_size(const request_rec *r);
+
+ /**
+  * Return the limit on bytes in request msg body
+  * @param r The current request
+@@ -672,6 +679,8 @@ typedef struct {
+ 
+     /** Table of rules for building CGI variables, NULL if none configured */
+     apr_hash_t *cgi_var_rules;
+
+    apr_size_t read_buf_size;
+ } core_dir_config;
+ 
+ /* macro to implement off by default behaviour */
+@@ -741,6 +750,9 @@ typedef struct {
+ #define AP_HTTP_METHODS_REGISTERED    2
+     char http_methods;
+     unsigned int merge_slashes;
+
+    apr_size_t   flush_max_threshold;
+    apr_int32_t  flush_max_pipelined;
+ } core_server_config;
+ 
+ /* for AddOutputFiltersByType in core.c */
+diff --git a/server/core.c b/server/core.c
+index 4e7acc8..c6e032c 100644
+--- a/server/core.c
+++ b/server/core.c
+@@ -22,6 +22,11 @@
+ #include "apr_thread_proc.h"    /* for RLIMIT stuff */
+ #include "apr_random.h"
+ 
+#include "apr_version.h"
+#if APR_MAJOR_VERSION < 2
+#include "apu_version.h"
+#endif
+
+ #define APR_WANT_IOVEC
+ #define APR_WANT_STRFUNC
+ #define APR_WANT_MEMFUNC
+@@ -87,6 +92,9 @@
+ #define AP_CONTENT_MD5_ON    1
+ #define AP_CONTENT_MD5_UNSET 2
+ 
+#define AP_FLUSH_MAX_THRESHOLD 65536
+#define AP_FLUSH_MAX_PIPELINED 5
+
+ APR_HOOK_STRUCT(
+     APR_HOOK_LINK(get_mgmt_items)
+     APR_HOOK_LINK(insert_network_bucket)
+@@ -397,6 +405,13 @@ static void *merge_core_dir_configs(apr_pool_t *a, void *basev, void *newv)
+         conf->enable_sendfile = new->enable_sendfile;
+     }
+ 
+    if (new->read_buf_size) {
+        conf->read_buf_size = new->read_buf_size;
+    }
+    else {
+        conf->read_buf_size = base->read_buf_size;
+    }
+
+     conf->allow_encoded_slashes = new->allow_encoded_slashes;
+     conf->decode_encoded_slashes = new->decode_encoded_slashes;
+ 
+@@ -468,14 +483,12 @@ static void *create_core_server_config(apr_pool_t *a, server_rec *s)
+         apr_table_setn(conf->accf_map, "http", "data");
+         apr_table_setn(conf->accf_map, "https", "data");
+ #endif
+        conf->flush_max_threshold = AP_FLUSH_MAX_THRESHOLD;
+        conf->flush_max_pipelined = AP_FLUSH_MAX_PIPELINED;
+     }
+-    /* pcalloc'ed - we have NULL's/0's
+-    else ** is_virtual ** {
+-        conf->ap_document_root = NULL;
+-        conf->access_name = NULL;
+-        conf->accf_map = NULL;
+    else {
+        conf->flush_max_pipelined = -1;
+     }
+-     */
+ 
+     /* initialization, no special case for global context */
+ 
+@@ -563,7 +576,14 @@ static void *merge_core_server_configs(apr_pool_t *p, void *basev, void *virtv)
+                                        base->protocols_honor_order :
+                                        virt->protocols_honor_order);
+     AP_CORE_MERGE_FLAG(merge_slashes, conf, base, virt);
+-    
+
+    conf->flush_max_threshold = (virt->flush_max_threshold)
+                                  ? virt->flush_max_threshold
+                                  : base->flush_max_threshold;
+    conf->flush_max_pipelined = (virt->flush_max_pipelined >= 0)
+                                  ? virt->flush_max_pipelined
+                                  : base->flush_max_pipelined;
+
+     return conf;
+ }
+ 
+@@ -1225,6 +1245,12 @@ AP_DECLARE(apr_off_t) ap_get_limit_req_body(const request_rec *r)
+     return d->limit_req_body;
+ }
+ 
+AP_DECLARE(apr_size_t) ap_get_read_buf_size(const request_rec *r)
+{
+    core_dir_config *d = ap_get_core_module_config(r->per_dir_config);
+
+    return d->read_buf_size ? d->read_buf_size : AP_IOBUFSIZE;
+}
+ 
+ /*****************************************************************
+  *
+@@ -2229,6 +2255,64 @@ static const char *set_enable_sendfile(cmd_parms *cmd, void *d_,
+     return NULL;
+ }
+ 
+static const char *set_read_buf_size(cmd_parms *cmd, void *d_,
+                                     const char *arg)
+{
+    core_dir_config *d = d_;
+    apr_off_t size;
+    char *end;
+
+    if (apr_strtoff(&size, arg, &end, 10)
+            || size < 0 || size > APR_SIZE_MAX || *end)
+        return apr_pstrcat(cmd->pool,
+                           "parameter must be a number between 0 and "
+                           APR_STRINGIFY(APR_SIZE_MAX) "): ",
+                           arg, NULL);
+
+    d->read_buf_size = (apr_size_t)size;
+
+    return NULL;
+}
+
+static const char *set_flush_max_threshold(cmd_parms *cmd, void *d_,
+                                           const char *arg)
+{
+    core_server_config *conf =
+        ap_get_core_module_config(cmd->server->module_config);
+    apr_off_t size;
+    char *end;
+
+    if (apr_strtoff(&size, arg, &end, 10)
+            || size <= 0 || size > APR_SIZE_MAX || *end)
+        return apr_pstrcat(cmd->pool,
+                           "parameter must be a number between 1 and "
+                           APR_STRINGIFY(APR_SIZE_MAX) "): ",
+                           arg, NULL);
+
+    conf->flush_max_threshold = (apr_size_t)size;
+
+    return NULL;
+}
+
+static const char *set_flush_max_pipelined(cmd_parms *cmd, void *d_,
+                                           const char *arg)
+{
+    core_server_config *conf =
+        ap_get_core_module_config(cmd->server->module_config);
+    apr_off_t num;
+    char *end;
+
+    if (apr_strtoff(&num, arg, &end, 10)
+            || num < 0 || num > APR_INT32_MAX || *end)
+        return apr_pstrcat(cmd->pool,
+                           "parameter must be a number between 0 and "
+                           APR_STRINGIFY(APR_INT32_MAX) ": ",
+                           arg, NULL);
+
+    conf->flush_max_pipelined = (apr_int32_t)num;
+
+    return NULL;
+}
+ 
+ /*
+  * Report a missing-'>' syntax error.
+@@ -4403,6 +4487,12 @@ AP_INIT_TAKE1("EnableMMAP", set_enable_mmap, NULL, OR_FILEINFO,
+   "Controls whether memory-mapping may be used to read files"),
+ AP_INIT_TAKE1("EnableSendfile", set_enable_sendfile, NULL, OR_FILEINFO,
+   "Controls whether sendfile may be used to transmit files"),
+AP_INIT_TAKE1("ReadBufferSize", set_read_buf_size, NULL, OR_FILEINFO,
+  "Size (in bytes) of the memory buffers used to read data"),
+AP_INIT_TAKE1("FlushMaxThreshold", set_flush_max_threshold, NULL, RSRC_CONF,
+  "Maximum size (in bytes) above which pending data are flushed (blocking) to the network"),
+AP_INIT_TAKE1("FlushMaxPipelined", set_flush_max_pipelined, NULL, RSRC_CONF,
+  "Number of pipelined/pending responses above which they are flushed to the network"),
+ 
+ /* Old server config file commands */
+ 
+@@ -4847,6 +4937,11 @@ static int default_handler(request_rec *r)
+             if (d->enable_mmap == ENABLE_MMAP_OFF) {
+                 (void)apr_bucket_file_enable_mmap(e, 0);
+             }
+#endif
+#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 6)
+            if (d->read_buf_size) {
+                apr_bucket_file_set_buf_size(e, d->read_buf_size);
+            }
+ #endif
+         }
+ 
+-- 
+2.27.0
+
--- a/backport-CVE-2019-17567.patch
+++ b/backport-CVE-2019-17567.patch
--- a/backport-CVE-2023-31122-out-of-bound-Read.patch
+++ b/backport-CVE-2023-31122-out-of-bound-Read.patch
@ -0,0 +1,28 @@
+From c41eb3b14a3d1eb2e3c42c4728cc52a22748851a Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <icing@apache.org>
+Date: Mon, 16 Oct 2023 06:39:44 +0000
+Subject: [PATCH] mod_macro: out of bounds Read-2
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/c41eb3b14a3d1eb2e3c42c4728cc52a22748851a
+
+---
+ modules/core/mod_macro.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/core/mod_macro.c b/modules/core/mod_macro.c
+index 04af43b..cc42d0b 100644
+--- a/modules/core/mod_macro.c
+++ b/modules/core/mod_macro.c
+@@ -465,7 +465,7 @@ static const char *process_content(apr_pool_t * pool,
+     for (i = 0; i < contents->nelts; i++) {
+         const char *errmsg;
+         /* copy the line and substitute macro parameters */
+-        strncpy(line, ((char **) contents->elts)[i], MAX_STRING_LEN - 1);
+        apr_cpystrn(line, ((char **) contents->elts)[i], MAX_STRING_LEN);
+         errmsg = substitute_macro_args(line, MAX_STRING_LEN,
+                                        macro, replacements, used);
+         if (errmsg) {
+-- 
+2.23.0
+
--- a/backport-CVE-2023-38709-header-validation-after-content.patch
+++ b/backport-CVE-2023-38709-header-validation-after-content.patch
@ -0,0 +1,97 @@
+From ac20389f3c816d990aba21720f1492b69ac5cb44 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 3 Apr 2024 12:12:23 +0000
+Subject: [PATCH] header validation after content-* are eval'ed
+ 
+backport r1916770 from trunk
+Submitted By: ylavic
+ 
+ 
+ 
+ 
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916778 13f79535-47bb-0310-9956-ffa450edef68
+ 
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/ac20389f3c816d990aba21720f1492b69ac5cb44
+
+---
+ modules/http/http_filters.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index e9faa2e..4073fc9 100644
+--- a/modules/http/http_filters.c
+++ b/modules/http/http_filters.c
+@@ -1360,6 +1360,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+          */
+         apr_table_clear(r->headers_out);
+         apr_table_clear(r->err_headers_out);
+        r->content_type = r->content_encoding = NULL;
+        r->content_languages = NULL;
+        r->clength = r->chunked = 0;
+         apr_brigade_cleanup(b);
+ 
+         /* Don't recall ap_die() if we come back here (from its own internal
+@@ -1376,8 +1379,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         APR_BRIGADE_INSERT_TAIL(b, e);
+         e = apr_bucket_eos_create(c->bucket_alloc);
+         APR_BRIGADE_INSERT_TAIL(b, e);
+-        r->content_type = r->content_encoding = NULL;
+-        r->content_languages = NULL;
+         ap_set_content_length(r, 0);
+         recursive_error = 1;
+     }
+@@ -1404,6 +1405,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     if (!apr_is_empty_table(r->err_headers_out)) {
+         r->headers_out = apr_table_overlay(r->pool, r->err_headers_out,
+                                            r->headers_out);
+        apr_table_clear(r->err_headers_out);
+     }
+ 
+     /*
+@@ -1423,6 +1425,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         fixup_vary(r);
+     }
+ 
+
+    /*
+     * Control cachability for non-cacheable responses if not already set by
+     * some other part of the server configuration.
+     */
+    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
+        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
+        ap_recent_rfc822_date(date, r->request_time);
+        apr_table_addn(r->headers_out, "Expires", date);
+    }
+
+     /*
+      * Now remove any ETag response header field if earlier processing
+      * says so (such as a 'FileETag None' directive).
+@@ -1435,6 +1448,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     basic_http_header_check(r, &protocol);
+     ap_set_keepalive(r);
+ 
+    /* 204/304 responses don't have content related headers */
+     if (AP_STATUS_IS_HEADER_ONLY(r->status)) {
+         apr_table_unset(r->headers_out, "Transfer-Encoding");
+         apr_table_unset(r->headers_out, "Content-Length");
+@@ -1477,16 +1491,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         apr_table_setn(r->headers_out, "Content-Language", field);
+     }
+ 
+-    /*
+-     * Control cachability for non-cacheable responses if not already set by
+-     * some other part of the server configuration.
+-     */
+-    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
+-        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
+-        ap_recent_rfc822_date(date, r->request_time);
+-        apr_table_addn(r->headers_out, "Expires", date);
+-    }
+-
+     /* This is a hack, but I can't find anyway around it.  The idea is that
+      * we don't want to send out 0 Content-Lengths if it is a head request.
+      * This happens when modules try to outsmart the server, and return
+-- 
+2.33.0
+
--- a/backport-CVE-2023-45802-improved-early-cleanup-of-stream.patch
+++ b/backport-CVE-2023-45802-improved-early-cleanup-of-stream.patch
@ -0,0 +1,141 @@
+From decce82a706abd78dfc32821a03ad93841d7758a Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <icing@apache.org>
+Date: Mon, 16 Oct 2023 09:05:00 +0000
+Subject: [PATCH] mod_http2: improved early cleanup of streams
+
+Conflict:Some features of mod_http2 are added and most code of mod_http2
+is reconstructed in the pre-patch(9767274b884). Therefore, the pre-patch
+is not integrated. As a result, We need context adaptation.
+Reference:https://github.com/apache/httpd/commit/decce82a706abd78dfc32821a03ad93841d7758a
+
+---
+ changes-entries/h2_cleanup.txt |  2 ++
+ modules/http2/h2_mplx.c        | 26 ++++++++++++++++++++++----
+ modules/http2/h2_mplx.h        |  3 ++-
+ modules/http2/h2_session.c     | 18 +++++++++++++++++-
+ modules/http2/h2_stream.c      |  2 +-
+ 5 files changed, 44 insertions(+), 7 deletions(-)
+ create mode 100644 changes-entries/h2_cleanup.txt
+
+diff --git a/changes-entries/h2_cleanup.txt b/changes-entries/h2_cleanup.txt
+new file mode 100644
+index 0000000..b483f6a
+--- /dev/null
+++ b/changes-entries/h2_cleanup.txt
+@@ -0,0 +1,2 @@
+* mod_http2: improved early cleanup of streams
+  [Stefan Eissing]
+diff --git a/modules/http2/h2_mplx.c b/modules/http2/h2_mplx.c
+index 62c381d..dd0f737 100644
+--- a/modules/http2/h2_mplx.c
+++ b/modules/http2/h2_mplx.c
+@@ -1150,14 +1150,32 @@ int h2_mplx_m_awaits_data(h2_mplx *m)
+     return waiting;
+ }
+ 
+-apr_status_t h2_mplx_m_client_rst(h2_mplx *m, int stream_id)
+apr_status_t h2_mplx_m_client_rst(h2_mplx *m, int stream_id, h2_stream *stream)
+ {
+-    h2_stream *stream;
+     apr_status_t status = APR_SUCCESS;
+    int registered;
+     
+     H2_MPLX_ENTER_ALWAYS(m);
+-    stream = h2_ihash_get(m->streams, stream_id);
+-    if (stream && stream->task) {
+    registered = (h2_ihash_get(m->streams, stream_id) != NULL);
+    if (!stream) {
+        /* a RST might arrive so late, we have already forgotten
+         * about it. Seems ok. */
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, m->c1,
+                      H2_MPLX_MSG(m, "RST on unknown stream %d"), stream_id);
+        AP_DEBUG_ASSERT(!registered);
+    }
+    else if (!registered) {
+        /* a RST on a stream that mplx has not been told about, but
+         * which the session knows. Very early and annoying. */
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, m->c1,
+                      H2_STRM_MSG(stream, "very early RST, drop"));
+        h2_stream_set_monitor(stream, NULL);
+        h2_stream_rst(stream, H2_ERR_STREAM_CLOSED);
+        h2_stream_dispatch(stream, H2_SEV_EOS_SENT);
+        m_stream_cleanup(m, stream);
+        m_be_annoyed(m);
+    }
+    else if (!reset_is_acceptable(stream)) {
+         status = m_be_annoyed(m);
+     }
+     H2_MPLX_LEAVE(m);
+diff --git a/modules/http2/h2_mplx.h b/modules/http2/h2_mplx.h
+index c61629d..edcc1ee 100644
+--- a/modules/http2/h2_mplx.h
+++ b/modules/http2/h2_mplx.h
+@@ -187,7 +187,8 @@ typedef int h2_mplx_stream_cb(struct h2_stream *s, void *ctx);
+ 
+ apr_status_t h2_mplx_m_stream_do(h2_mplx *m, h2_mplx_stream_cb *cb, void *ctx);
+ 
+-apr_status_t h2_mplx_m_client_rst(h2_mplx *m, int stream_id);
+apr_status_t h2_mplx_m_client_rst(h2_mplx *m, int stream_id,
+                                  struct h2_stream *stream);
+ 
+ /**
+  * Master connection has entered idle mode.
+diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c
+index d657fce..aa2bf46 100644
+--- a/modules/http2/h2_session.c
+++ b/modules/http2/h2_session.c
+@@ -389,6 +389,10 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
+                           session->id, (int)frame->hd.stream_id,
+                           (int)frame->rst_stream.error_code);
+             stream = h2_session_stream_get(session, frame->hd.stream_id);
+            if (stream) {
+                rv = h2_stream_recv_frame(stream, NGHTTP2_RST_STREAM, frame->hd.flags,
+                    frame->h2.length + H2_FRAME_HDR_LEN);
+            }
+             if (stream && stream->initiated_on) {
+                 /* A stream reset on a request we sent it. Normal, when the
+                  * client does not want it. */
+@@ -397,7 +401,8 @@ static int on_frame_recv_cb(nghttp2_session *ng2s,
+             else {
+                 /* A stream reset on a request it sent us. Could happen in a browser
+                  * when the user navigates away or cancels loading - maybe. */
+-                h2_mplx_m_client_rst(session->mplx, frame->hd.stream_id);
+                h2_mplx_m_client_rst(session->mplx, frame->hd.stream_id,
+                                     stream);
+                 ++session->streams_reset;
+             }
+             break;
+@@ -778,6 +783,17 @@ static apr_status_t session_cleanup(h2_session *session, const char *trigger)
+                       "goodbye, clients will be confused, should not happen"));
+     }
+ 
+    if (!h2_iq_empty(session->ready_to_process)) {
+        int sid;
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
+                      H2_SSSN_LOG(APLOGNO(), session,
+                      "cleanup, resetting %d streams in ready-to-process"),
+                      h2_iq_count(session->ready_to_process));
+        while ((sid = h2_iq_shift(session->ready_to_process)) > 0) {
+            h2_mplx_m_client_rst(session->mplx, sid, get_stream(session, sid));
+        }
+    }
+
+     transit(session, trigger, H2_SESSION_ST_CLEANUP);
+     h2_mplx_m_release_and_join(session->mplx, session->iowait);
+     session->mplx = NULL;
+diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c
+index eb61add..1482086 100644
+--- a/modules/http2/h2_stream.c
+++ b/modules/http2/h2_stream.c
+@@ -120,7 +120,7 @@ static int trans_on_event[][H2_SS_MAX] = {
+ { S_XXX, S_ERR,  S_ERR,  S_CL_L, S_CLS,  S_XXX,  S_XXX,  S_XXX, },/* EV_CLOSED_L*/
+ { S_ERR, S_ERR,  S_ERR,  S_CL_R, S_ERR,  S_CLS,  S_NOP,  S_NOP, },/* EV_CLOSED_R*/
+ { S_CLS, S_CLS,  S_CLS,  S_CLS,  S_CLS,  S_CLS,  S_NOP,  S_NOP, },/* EV_CANCELLED*/
+-{ S_NOP, S_XXX,  S_XXX,  S_XXX,  S_XXX,  S_CLS,  S_CLN,  S_XXX, },/* EV_EOS_SENT*/
+{ S_NOP, S_XXX,  S_XXX,  S_XXX,  S_XXX,  S_CLS,  S_CLN,  S_NOP, },/* EV_EOS_SENT*/
+ };
+ 
+ static int on_map(h2_stream_state_t state, int map[H2_SS_MAX])
+-- 
+2.23.0
+
--- a/backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch
+++ b/backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch
@ -0,0 +1,221 @@
+From a29723ce1af75eed0813c3717d3f6dee9b405ca8 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 3 Apr 2024 12:10:49 +0000
+Subject: [PATCH] let httpd handle CL/TE for non-http handlers
+
+backport r1916769 from trunk:
+Submitted By: ylavic, covener
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916777 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/a29723ce1af75eed0813c3717d3f6dee9b405ca8
+
+---
+ include/util_script.h           |  2 ++
+ modules/aaa/mod_authnz_fcgi.c   |  8 ++++++++
+ modules/generators/mod_cgi.c    | 15 ++++++++++++---
+ modules/generators/mod_cgid.c   | 15 ++++++++++++---
+ modules/http/http_filters.c     | 12 ++++++++++++
+ modules/proxy/ajp_header.c      | 10 ++++++++++
+ modules/proxy/mod_proxy_fcgi.c  |  9 +++++++++
+ modules/proxy/mod_proxy_scgi.c  |  8 ++++++++
+ modules/proxy/mod_proxy_uwsgi.c |  6 ++++++
+ 9 files changed, 79 insertions(+), 6 deletions(-)
+
+diff --git a/include/util_script.h b/include/util_script.h
+index 3566bd3..0557c7f 100644
+--- a/include/util_script.h
+++ b/include/util_script.h
+@@ -225,6 +225,8 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
+  */
+ AP_DECLARE(void) ap_args_to_table(request_rec *r, apr_table_t **table);
+ 
+#define AP_TRUST_CGILIKE_CL_ENVVAR "ap_trust_cgilike_cl"
+
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/modules/aaa/mod_authnz_fcgi.c b/modules/aaa/mod_authnz_fcgi.c
+index d99f391..d4be53e 100644
+--- a/modules/aaa/mod_authnz_fcgi.c
+++ b/modules/aaa/mod_authnz_fcgi.c
+@@ -571,6 +571,14 @@ static apr_status_t handle_response(const fcgi_provider_conf *conf,
+                                       "parsing -> %d/%d",
+                                       fn, status, r->status);
+ 
+                        /* FCGI has its own body framing mechanism which we don't
+                         * match against any provided Content-Length, so let the
+                         * core determine C-L vs T-E based on what's actually sent.
+                         */
+                        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+                            apr_table_unset(r->headers_out, "Content-Length");
+                        apr_table_unset(r->headers_out, "Transfer-Encoding");
+
+                         if (rspbuf) { /* caller wants to see response body,
+                                        * if any
+                                        */
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 7e4b126..96bb883 100644
+--- a/modules/generators/mod_cgi.c
+++ b/modules/generators/mod_cgi.c
+@@ -935,9 +935,18 @@ static int cgi_handler(request_rec *r)
+         char sbuf[MAX_STRING_LEN];
+         int ret;
+ 
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+                                                   APLOG_MODULE_INDEX);
+
+        /* xCGI has its own body framing mechanism which we don't
+         * match against any provided Content-Length, so let the
+         * core determine C-L vs T-E based on what's actually sent.
+         */
+        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+            apr_table_unset(r->headers_out, "Content-Length");
+        apr_table_unset(r->headers_out, "Transfer-Encoding");
+
+        if (ret != OK) {
+             ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
+ 
+             /*
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index 9f4282c..1a67779 100644
+--- a/modules/generators/mod_cgid.c
+++ b/modules/generators/mod_cgid.c
+@@ -1614,9 +1614,18 @@ static int cgid_handler(request_rec *r)
+         b = apr_bucket_eos_create(c->bucket_alloc);
+         APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+                                                   APLOG_MODULE_INDEX);
+
+        /* xCGI has its own body framing mechanism which we don't
+         * match against any provided Content-Length, so let the
+         * core determine C-L vs T-E based on what's actually sent.
+         */
+        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+            apr_table_unset(r->headers_out, "Content-Length");
+        apr_table_unset(r->headers_out, "Transfer-Encoding");
+
+        if (ret != OK) {
+             ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
+ 
+             /*
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index f25d6f0..e9faa2e 100644
+--- a/modules/http/http_filters.c
+++ b/modules/http/http_filters.c
+@@ -773,6 +773,18 @@ static APR_INLINE int check_headers(request_rec *r)
+     struct check_header_ctx ctx;
+     core_server_config *conf =
+             ap_get_core_module_config(r->server->module_config);
+    const char *val;
+ 
+    if ((val = apr_table_get(r->headers_out, "Transfer-Encoding"))) {
+        if (apr_table_get(r->headers_out, "Content-Length")) {
+            apr_table_unset(r->headers_out, "Content-Length");
+            r->connection->keepalive = AP_CONN_CLOSE;
+        }
+        if (!ap_is_chunked(r->pool, val)) {
+            r->connection->keepalive = AP_CONN_CLOSE;
+            return 0;
+        }
+    }
+ 
+     ctx.r = r;
+     ctx.strict = (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE);
+diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
+index 76989c8..c0a2dd7 100644
+--- a/modules/proxy/ajp_header.c
+++ b/modules/proxy/ajp_header.c
+@@ -17,6 +17,8 @@
+ #include "ajp_header.h"
+ #include "ajp.h"
+ 
+#include "util_script.h"
+
+ APLOG_USE_MODULE(proxy_ajp);
+ 
+ static const char *response_trans_headers[] = {
+@@ -662,6 +664,14 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+         }
+     }
+ 
+    /* AJP has its own body framing mechanism which we don't
+     * match against any provided Content-Length, so let the
+     * core determine C-L vs T-E based on what's actually sent.
+     */
+    if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+        apr_table_unset(r->headers_out, "Content-Length");
+    apr_table_unset(r->headers_out, "Transfer-Encoding");
+
+     return APR_SUCCESS;
+ }
+ 
+diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
+index 2e97408..08b4c3f 100644
+--- a/modules/proxy/mod_proxy_fcgi.c
+++ b/modules/proxy/mod_proxy_fcgi.c
+@@ -735,6 +735,15 @@ recv_again:
+ 
+                             status = ap_scan_script_header_err_brigade_ex(r, ob,
+                                 NULL, APLOG_MODULE_INDEX);
+
+                            /* FCGI has its own body framing mechanism which we don't
+                             * match against any provided Content-Length, so let the
+                             * core determine C-L vs T-E based on what's actually sent.
+                             */
+                            if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+                                apr_table_unset(r->headers_out, "Content-Length");
+                            apr_table_unset(r->headers_out, "Transfer-Encoding");
+
+                             /* suck in all the rest */
+                             if (status != OK) {
+                                 apr_bucket *tmp_b;
+diff --git a/modules/proxy/mod_proxy_scgi.c b/modules/proxy/mod_proxy_scgi.c
+index 11f75de..2a11ef8 100644
+--- a/modules/proxy/mod_proxy_scgi.c
+++ b/modules/proxy/mod_proxy_scgi.c
+@@ -388,6 +388,14 @@ static int pass_response(request_rec *r, proxy_conn_rec *conn)
+         return status;
+     }
+ 
+    /* SCGI has its own body framing mechanism which we don't
+     * match against any provided Content-Length, so let the
+     * core determine C-L vs T-E based on what's actually sent.
+     */
+    if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
+        apr_table_unset(r->headers_out, "Content-Length");
+    apr_table_unset(r->headers_out, "Transfer-Encoding");
+
+     conf = ap_get_module_config(r->per_dir_config, &proxy_scgi_module);
+     if (conf->sendfile && conf->sendfile != scgi_sendfile_off) {
+         short err = 1;
+diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
+index cc5cda7..e865d04 100644
+--- a/modules/proxy/mod_proxy_uwsgi.c
+++ b/modules/proxy/mod_proxy_uwsgi.c
+@@ -382,6 +382,12 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend,
+         return HTTP_BAD_GATEWAY;
+     }
+ 
+    /* T-E wins over C-L */
+    if (apr_table_get(r->headers_out, "Transfer-Encoding")) {
+        apr_table_unset(r->headers_out, "Content-Length");
+        backend->close = 1;
+    }
+
+     if ((buf = apr_table_get(r->headers_out, "Content-Type"))) {
+         ap_set_content_type(r, apr_pstrdup(r->pool, buf));
+     }
+-- 
+2.33.0
+
--- a/backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch
+++ b/backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch
@ -0,0 +1,70 @@
+From 0d73970ec161300a55b630f71bbf72b5c41f28b9 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 3 Apr 2024 12:12:55 +0000
+Subject: [PATCH] Merge r1916771 from trunk:
+ 
+bail after too many failed reads
+ 
+Submitted By: icing
+ 
+ 
+ 
+ 
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916779 13f79535-47bb-0310-9956-ffa450edef68
+ 
+Conflict:The mod_http2 version upgrade (9767274) and new feature (06ceb22) are not integrated. As a result, context adaptation exists in h2_session.c.
+Reference:https://github.com/apache/httpd/commit/0d73970ec161300a55b630f71bbf72b5c41f28b9
+
+---
+ modules/http2/h2_session.c | 7 ++++++-
+ modules/http2/h2_stream.c  | 1 +
+ modules/http2/h2_stream.h  | 3 ++-
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c
+index aa2bf46..445f583 100644
+--- a/modules/http2/h2_session.c
+++ b/modules/http2/h2_session.c
+@@ -311,7 +311,12 @@ static int on_header_cb(nghttp2_session *ngh2, const nghttp2_frame *frame,
+     
+     status = h2_stream_add_header(stream, (const char *)name, namelen,
+                                   (const char *)value, valuelen);
+-    if (status != APR_SUCCESS && !h2_stream_is_ready(stream)) {
+    if (status != APR_SUCCESS && 
+        !h2_stream_is_ready(stream) ||
+        /* We accept a certain amount of failures in order to reply
+         * with an informative HTTP error response like 413. But if the
+         * client is too wrong, we fail the request a RESET of the stream */
+	stream->request_headers_failed > 100) {
+         return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+     }
+     return 0;
+diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c
+index 1482086..fad1df1 100644
+--- a/modules/http2/h2_stream.c
+++ b/modules/http2/h2_stream.c
+@@ -733,6 +733,7 @@ apr_status_t h2_stream_add_header(h2_stream *stream,
+     }
+     
+     if (error) {
+        ++stream->request_headers_failed;
+         set_error_response(stream, error);
+         return APR_EINVAL; 
+     }
+diff --git a/modules/http2/h2_stream.h b/modules/http2/h2_stream.h
+index 9761ed7..1af1256 100644
+--- a/modules/http2/h2_stream.h
+++ b/modules/http2/h2_stream.h
+@@ -75,7 +75,8 @@ struct h2_stream {
+     struct h2_request *rtmp;    /* request being assembled */
+     apr_table_t *trailers;      /* optional incoming trailers */
+     int request_headers_added;  /* number of request headers added */
+-    
+    int request_headers_failed; /* number of request headers failed to add */
+
+     struct h2_bucket_beam *input;
+     apr_bucket_brigade *in_buffer;
+     int in_window_size;
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch
+++ b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch
@ -0,0 +1,79 @@
+From 93aec0e3ca451bcc97f6d91c14d5399d13a73365 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 25 Jun 2024 15:28:00 +0000
+Subject: [PATCH] Merge r1918553 from trunk:
+
+block inadvertent subst of special filenames
+
+ cosmetic merge conflicts
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918600 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/93aec0e3ca451bcc97f6d91c14d5399d13a73365
+
+---
+ modules/mappers/mod_rewrite.c | 38 ++++++++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 80fdbde..86348b3 100644
+--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
+@@ -4208,6 +4208,32 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+         return 2;
+     }
+ 
+    /* Add the previously stripped per-directory location prefix, unless
+     * (1) it's an absolute URL path and
+     * (2) it's a full qualified URL
+     */
+    if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
+        if (ctx->perdir) {
+            rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                       newuri, ctx->perdir, newuri));
+
+            newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
+        }
+        else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
+            /* Not an absolute URI-path and the scheme (if any) is unknown,
+             * and it won't be passed to fully_qualify_uri() below either,
+             * so add an implicit '/' prefix. This avoids potentially a common
+             * rule like "RewriteRule ^/some/path(.*) $1" that is given a path
+             * like "/some/pathscheme:..." to produce the fully qualified URL
+             * "scheme:..." which could be misinterpreted later.
+             */
+            rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s",
+                       newuri, newuri));
+
+            newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
+        }
+    }
+
+     /* Now adjust API's knowledge about r->filename and r->args */
+     r->filename = newuri;
+ 
+@@ -4219,18 +4245,6 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                           p->flags & RULEFLAG_QSDISCARD, 
+                           p->flags & RULEFLAG_QSLAST);
+ 
+-    /* Add the previously stripped per-directory location prefix, unless
+-     * (1) it's an absolute URL path and
+-     * (2) it's a full qualified URL
+-     */
+-    if (   ctx->perdir && !is_proxyreq && *r->filename != '/'
+-        && !is_absolute_uri(r->filename, NULL)) {
+-        rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+-                    r->filename, ctx->perdir, r->filename));
+-
+-        r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL);
+-    }
+-
+     /* If this rule is forced for proxy throughput
+      * (`RewriteRule ... ... [P]') then emulate mod_proxy's
+      * URL-to-filename handler to be sure mod_proxy is triggered
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch
+++ b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch
@ -0,0 +1,58 @@
+From cc00cf6b4e37370897daddc307bf1deecf8fedfa Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 25 Jun 2024 20:20:05 +0000
+Subject: [PATCH] Merge r1918623 from trunk:
+
+fix comparison of local path on Windows
+
+Submitted By: Yann Ylavic
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918625 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/cc00cf6b4e37370897daddc307bf1deecf8fedfa
+
+---
+ modules/mappers/mod_rewrite.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 86348b3..9149023 100644
+--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
+@@ -632,6 +632,19 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs)
+     return 0;
+ }
+ 
+static int is_absolute_path(const char *path)
+{
+#ifndef WIN32
+    return (path[0] == '/');
+#else
+#define IS_SLASH(c) ((c) == '/' || (c) == '\\')
+    /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */
+    return ((IS_SLASH(path[0]) && path[1] == path[0])
+            || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2])));
+#undef IS_SLASH
+#endif
+}
+
+ static const char c2x_table[] = "0123456789abcdef";
+ 
+ static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix,
+@@ -4212,7 +4225,9 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+      * (1) it's an absolute URL path and
+      * (2) it's a full qualified URL
+      */
+-    if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
+    if (!is_proxyreq
+        && !is_absolute_path(newuri)
+        && !is_absolute_uri(newuri, NULL)) {
+         if (ctx->perdir) {
+             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                        newuri, ctx->perdir, newuri));
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38473-fix-the-filename-redirected.patch
+++ b/backport-CVE-2024-38473-fix-the-filename-redirected.patch
@ -0,0 +1,204 @@
+From 4326d6b9041a3bcb9b529f9163d0761c2d760700 Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Wed, 26 Jun 2024 14:56:47 +0000
+Subject: [PATCH] factor out IS_SLASH, perdir fix
+
+in per-dir, the filename will be internally redirected, so / is OK too.
+
+
+don't add / to / in the non-perdir
+
+
+match AP_IS_SLASH macro
+
+followup to 1918651
+
+
+Merges r1918651, r1918652, r1918663 from trunk
+Reviewed by: covener, ylavic, rpluem
+GH: close #458
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918668 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/4326d6b9041a3bcb9b529f9163d0761c2d760700
+
+---
+ include/ap_mmn.h              |  3 ++-
+ include/httpd.h               | 11 +++++++++++
+ modules/mappers/mod_rewrite.c | 11 ++++-------
+ server/util.c                 | 31 ++++++++++---------------------
+ 4 files changed, 27 insertions(+), 29 deletions(-)
+
+diff --git a/include/ap_mmn.h b/include/ap_mmn.h
+index ab88f82..76600b7 100644
+--- a/include/ap_mmn.h
+++ b/include/ap_mmn.h
+@@ -541,6 +541,7 @@
+  *                          flush_max_threshold and flush_max_pipelined to
+  *                          core_server_config, and ap_get_read_buf_size().
+  * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename()
+ * 20120211.134 (2.4.60-dev) AP_SLASHES and AP_IS_SLASH
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+@@ -548,7 +549,7 @@
+ #ifndef MODULE_MAGIC_NUMBER_MAJOR
+ #define MODULE_MAGIC_NUMBER_MAJOR 20120211
+ #endif
+-#define MODULE_MAGIC_NUMBER_MINOR 133                  /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 134                  /* 0...n */
+ 
+ /**
+  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
+diff --git a/include/httpd.h b/include/httpd.h
+index f5e64cc..acb4c5f 100644
+--- a/include/httpd.h
+++ b/include/httpd.h
+@@ -2504,6 +2504,17 @@ AP_DECLARE(const char *)ap_dir_fnmatch(ap_dir_match_t *w, const char *path,
+  */
+ AP_DECLARE(int) ap_is_chunked(apr_pool_t *p, const char *line);
+ 
+/* Win32/NetWare/OS2 need to check for both forward and back slashes
+ * in ap_normalize_path() and ap_escape_url().
+ */
+#ifdef CASE_BLIND_FILESYSTEM
+#define AP_IS_SLASH(s) ((s == '/') || (s == '\\'))
+#define AP_SLASHES "/\\"
+#else
+#define AP_IS_SLASH(s) (s == '/')
+#define AP_SLASHES "/"
+#endif
+
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 9149023..a0f67a8 100644
+--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
+@@ -634,14 +634,11 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs)
+ 
+ static int is_absolute_path(const char *path)
+ {
+-#ifndef WIN32
+#ifndef CASE_BLIND_FILESYSTEM
+     return (path[0] == '/');
+ #else
+-#define IS_SLASH(c) ((c) == '/' || (c) == '\\')
+-    /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */
+-    return ((IS_SLASH(path[0]) && path[1] == path[0])
+-            || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2])));
+-#undef IS_SLASH
+    return ((AP_IS_SLASH(path[0]) && path[1] == path[0])
+            || (apr_isalpha(path[0]) && path[1] == ':' && AP_IS_SLASH(path[2])));
+ #endif
+ }
+ 
+@@ -4227,11 +4224,11 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+      */
+     if (!is_proxyreq
+         && !is_absolute_path(newuri)
+        && !AP_IS_SLASH(*newuri)
+         && !is_absolute_uri(newuri, NULL)) {
+         if (ctx->perdir) {
+             rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+                        newuri, ctx->perdir, newuri));
+-
+             newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
+         }
+         else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
+diff --git a/server/util.c b/server/util.c
+index 0f05110..1bdfe70 100644
+--- a/server/util.c
+++ b/server/util.c
+@@ -75,17 +75,6 @@
+  */
+ #include "test_char.h"
+ 
+-/* Win32/NetWare/OS2 need to check for both forward and back slashes
+- * in ap_getparents() and ap_escape_url.
+- */
+-#ifdef CASE_BLIND_FILESYSTEM
+-#define IS_SLASH(s) ((s == '/') || (s == '\\'))
+-#define SLASHES "/\\"
+-#else
+-#define IS_SLASH(s) (s == '/')
+-#define SLASHES "/"
+-#endif
+-
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -506,8 +495,8 @@ AP_DECLARE(void) ap_getparents(char *name)
+ 
+     l = w = first_dot = next - name;
+     while (name[l] != '\0') {
+-        if (name[l] == '.' && IS_SLASH(name[l + 1])
+-            && (l == 0 || IS_SLASH(name[l - 1])))
+        if (name[l] == '.' && AP_IS_SLASH(name[l + 1])
+            && (l == 0 || AP_IS_SLASH(name[l - 1])))
+             l += 2;
+         else
+             name[w++] = name[l++];
+@@ -516,7 +505,7 @@ AP_DECLARE(void) ap_getparents(char *name)
+     /* b) remove trailing . path, segment */
+     if (w == 1 && name[0] == '.')
+         w--;
+-    else if (w > 1 && name[w - 1] == '.' && IS_SLASH(name[w - 2]))
+    else if (w > 1 && name[w - 1] == '.' && AP_IS_SLASH(name[w - 2]))
+         w--;
+     name[w] = '\0';
+ 
+@@ -524,13 +513,13 @@ AP_DECLARE(void) ap_getparents(char *name)
+     l = first_dot;
+ 
+     while (name[l] != '\0') {
+-        if (name[l] == '.' && name[l + 1] == '.' && IS_SLASH(name[l + 2])
+-            && (l == 0 || IS_SLASH(name[l - 1]))) {
+        if (name[l] == '.' && name[l + 1] == '.' && AP_IS_SLASH(name[l + 2])
+            && (l == 0 || AP_IS_SLASH(name[l - 1]))) {
+             int m = l + 3, n;
+ 
+             l = l - 2;
+             if (l >= 0) {
+-                while (l >= 0 && !IS_SLASH(name[l]))
+                while (l >= 0 && !AP_IS_SLASH(name[l]))
+                     l--;
+                 l++;
+             }
+@@ -548,10 +537,10 @@ AP_DECLARE(void) ap_getparents(char *name)
+     if (l == 2 && name[0] == '.' && name[1] == '.')
+         name[0] = '\0';
+     else if (l > 2 && name[l - 1] == '.' && name[l - 2] == '.'
+-             && IS_SLASH(name[l - 3])) {
+             && AP_IS_SLASH(name[l - 3])) {
+         l = l - 4;
+         if (l >= 0) {
+-            while (l >= 0 && !IS_SLASH(name[l]))
+            while (l >= 0 && !AP_IS_SLASH(name[l]))
+                 l--;
+             l++;
+         }
+@@ -1884,7 +1873,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved)
+ AP_DECLARE(int) ap_unescape_url(char *url)
+ {
+     /* Traditional */
+-    return unescape_url(url, SLASHES, NULL);
+    return unescape_url(url, AP_SLASHES, NULL);
+ }
+ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes)
+ {
+@@ -1894,7 +1883,7 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes)
+         return unescape_url(url, NULL, NULL);
+     } else {
+         /* reserve (do not decode) encoded slashes */
+-        return unescape_url(url, NULL, SLASHES);
+        return unescape_url(url, NULL, AP_SLASHES);
+     }
+ }
+ #ifdef NEW_APIS
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch
+++ b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch
@ -0,0 +1,236 @@
+From 6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Wed, 26 Jun 2024 14:51:32 +0000
+Subject: [PATCH] mod_proxy: Fixup UDS filename for mod_proxy called through
+ r->handler.
+
+* modules/proxy/proxy_util.c:
+  Export ap_proxy_fixup_uds_filename() from fix_uds_filename.
+  Call it from ap_proxy_pre_request() even for rewritten balancer workers.
+
+* modules/proxy/mod_proxy.h:
+  Declare ap_proxy_fixup_uds_filename()
+
+* modules/proxy/mod_proxy.c:
+  Fixup UDS filename from r->handler in proxy_handler().
+
+* include/ap_mmn.h:
+  Bump MMN minor for ap_proxy_fixup_uds_filename()
+
+
+mod_proxy: follow up to r1918626: Simplify ap_proxy_fixup_uds_filename() and callers.
+
+
+Merges r1918626, r1918647 from trunk
+GH: closes #457
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918666 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:Version adaptation exists in ap_mmn.h
+Reference:https://github.com/apache/httpd/commit/6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce
+
+---
+ include/ap_mmn.h           |  3 ++-
+ modules/proxy/mod_proxy.c  | 33 ++++++++++++++++++------------
+ modules/proxy/mod_proxy.h  |  8 ++++++++
+ modules/proxy/proxy_util.c | 41 ++++++++++++++++++++++----------------
+ 4 files changed, 54 insertions(+), 31 deletions(-)
+
+diff --git a/include/ap_mmn.h b/include/ap_mmn.h
+index 2d87cb6..ab88f82 100644
+--- a/include/ap_mmn.h
+++ b/include/ap_mmn.h
+@@ -540,6 +540,7 @@
+  * 20120211.94 (2.4.47-dev) Add read_buf_size member to core_dir_config,
+  *                          flush_max_threshold and flush_max_pipelined to
+  *                          core_server_config, and ap_get_read_buf_size().
+ * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename()
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+@@ -547,7 +548,7 @@
+ #ifndef MODULE_MAGIC_NUMBER_MAJOR
+ #define MODULE_MAGIC_NUMBER_MAJOR 20120211
+ #endif
+-#define MODULE_MAGIC_NUMBER_MINOR 94                  /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 133                  /* 0...n */
+ 
+ /**
+  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
+diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
+index 0ba890a..a54fa75 100644
+--- a/modules/proxy/mod_proxy.c
+++ b/modules/proxy/mod_proxy.c
+@@ -969,6 +969,7 @@ static int proxy_fixup(request_rec *r)
+ 
+     return OK;      /* otherwise; we've done the best we can */
+ }
+
+ /* Send a redirection if the request contains a hostname which is not */
+ /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */
+ /* servers like Netscape's allow this and access hosts from the local */
+@@ -1022,7 +1023,7 @@ static int proxy_handler(request_rec *r)
+         ap_get_module_config(sconf, &proxy_module);
+     apr_array_header_t *proxies = conf->proxies;
+     struct proxy_remote *ents = (struct proxy_remote *) proxies->elts;
+-    int i, rc, access_status;
+    int rc = DECLINED, access_status, i;
+     int direct_connect = 0;
+     const char *str;
+     apr_int64_t maxfwd;
+@@ -1037,22 +1038,28 @@ static int proxy_handler(request_rec *r)
+         return DECLINED;
+     }
+ 
+-    if (!r->proxyreq) {
+-        rc = DECLINED;
+-        /* We may have forced the proxy handler via config or .htaccess */
+-        if (r->handler &&
+-            strncmp(r->handler, "proxy:", 6) == 0 &&
+-            strncmp(r->filename, "proxy:", 6) != 0) {
+-            r->proxyreq = PROXYREQ_REVERSE;
+-            r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
+-            /* Still need to fixup/canonicalize r->filename */
+    /* We may have forced the proxy handler via config or .htaccess */
+    if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) {
+        char *old_filename = r->filename;
+
+        r->proxyreq = PROXYREQ_REVERSE;
+        r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
+
+        /* Still need to fixup/canonicalize r->filename */
+        rc = ap_proxy_fixup_uds_filename(r);
+        if (rc <= OK) {
+             rc = proxy_fixup(r);
+         }
+         if (rc != OK) {
+-            return rc;
+            r->filename = old_filename;
+            r->proxyreq = 0;
+         }
+-    } else if (strncmp(r->filename, "proxy:", 6) != 0) {
+-        return DECLINED;
+    }
+    else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) {
+        rc = OK;
+    }
+    if (rc != OK) {
+        return rc;
+     }
+ 
+     /* handle max-forwards / OPTIONS / TRACE */
+diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
+index e522a96..0a8e1c4 100644
+--- a/modules/proxy/mod_proxy.h
+++ b/modules/proxy/mod_proxy.h
+@@ -912,6 +912,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov
+                                                                  proxy_balancer *balancer,
+                                                                  unsigned int *index);
+ 
+/*
+ * Strip the UDS part of r->filename if any, and put the UDS path in
+ * r->notes ("uds_path")
+ * @param r        current request
+ * @return         OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error
+ */
+PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r);
+
+ /**
+  * Get the most suitable worker and/or balancer for the request
+  * @param worker   worker used for processing request
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 7ae239e..79e12fc 100644
+--- a/modules/proxy/proxy_util.c
+++ b/modules/proxy/proxy_util.c
+@@ -2121,7 +2121,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke
+  * were passed a UDS url (eg: from mod_proxy) and adjust uds_path
+  * as required.  
+  */
+-static int fix_uds_filename(request_rec *r, char **url) 
+PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) 
+ {
+     char *uds_url = r->filename + 6, *origin_url;
+ 
+@@ -2129,7 +2129,6 @@ static int fix_uds_filename(request_rec *r, char **url)
+             !ap_cstr_casecmpn(uds_url, "unix:", 5) &&
+             (origin_url = ap_strchr(uds_url + 5, '|'))) {
+         char *uds_path = NULL;
+-        apr_size_t url_len;
+         apr_uri_t urisock;
+         apr_status_t rv;
+ 
+@@ -2144,20 +2143,20 @@ static int fix_uds_filename(request_rec *r, char **url)
+         if (!uds_path) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292)
+                     "Invalid proxy UDS filename (%s)", r->filename);
+-            return 0;
+            return HTTP_BAD_REQUEST;
+         }
+         apr_table_setn(r->notes, "uds_path", uds_path);
+ 
+-        /* Remove the UDS path from *url and r->filename */
+-        url_len = strlen(origin_url);
+-        *url = apr_pstrmemdup(r->pool, origin_url, url_len);
+-        memcpy(uds_url, *url, url_len + 1);
+-
+         ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
+-                "*: rewrite of url due to UDS(%s): %s (%s)",
+-                uds_path, *url, r->filename);
+                "*: fixup UDS from %s: %s (%s)",
+                r->filename, origin_url, uds_path);
+
+        /* Overwrite the UDS part in place */
+        memmove(uds_url, origin_url, strlen(origin_url) + 1);
+        return OK;
+     }
+-    return 1;
+
+    return DECLINED;
+ }
+ 
+ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+@@ -2175,9 +2174,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
+                           "%s: found worker %s for %s",
+                           (*worker)->s->scheme, (*worker)->s->name, *url);
+-            if (!forward && !fix_uds_filename(r, url)) {
+-                return HTTP_INTERNAL_SERVER_ERROR;
+-            }
+             access_status = OK;
+         }
+         else if (forward) {
+@@ -2207,9 +2203,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+                  * regarding the Connection header in the request.
+                  */
+                 apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1");
+-                if (!fix_uds_filename(r, url)) {
+-                    return HTTP_INTERNAL_SERVER_ERROR;
+-                }
+             }
+         }
+     }
+@@ -2219,6 +2212,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+                       "all workers are busy.  Unable to serve %s", *url);
+         access_status = HTTP_SERVICE_UNAVAILABLE;
+     }
+
+    if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) {
+        int rc = ap_proxy_fixup_uds_filename(r);
+        if (ap_is_HTTP_ERROR(rc)) {
+            return rc;
+        }
+        /* If the URL has changed in r->filename, take everything after
+         * the "proxy:" prefix.
+         */
+        if (rc == OK) {
+            *url = apr_pstrdup(r->pool, r->filename + 6);
+        }
+    }
+
+     return access_status;
+ }
+ 
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch
+++ b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch
@ -0,0 +1,44 @@
+From b10cb2d69184843832d501a615abe3e8e5e256dc Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:52:31 +0000
+Subject: [PATCH] Merge r1918550 from trunk:
+
+mod_proxy: escape for non-proxypass configuration
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918559 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/b10cb2d69184843832d501a615abe3e8e5e256dc
+
+---
+ modules/proxy/mod_proxy.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
+index 8a891ee..0ba890a 100644
+--- a/modules/proxy/mod_proxy.c
+++ b/modules/proxy/mod_proxy.c
+@@ -1038,15 +1038,18 @@ static int proxy_handler(request_rec *r)
+     }
+ 
+     if (!r->proxyreq) {
+        rc = DECLINED;
+         /* We may have forced the proxy handler via config or .htaccess */
+         if (r->handler &&
+             strncmp(r->handler, "proxy:", 6) == 0 &&
+             strncmp(r->filename, "proxy:", 6) != 0) {
+             r->proxyreq = PROXYREQ_REVERSE;
+             r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
+            /* Still need to fixup/canonicalize r->filename */
+            rc = proxy_fixup(r);
+         }
+-        else {
+-            return DECLINED;
+        if (rc != OK) {
+            return rc;
+         }
+     } else if (strncmp(r->filename, "proxy:", 6) != 0) {
+         return DECLINED;
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch
+++ b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch
@ -0,0 +1,405 @@
+From 1feb5e04a4f7b5f3f13cd40f9635144319dcf24a Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:58:17 +0000
+Subject: [PATCH] Merge r1918552 from trunk:
+
+tighten up prefix_stat and %3f handling
+
+Require opt-ins for unsafe substitutions
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918561 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:The XML file does not exist. Therefore, the file is not modified.
+Reference:https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a
+
+---
+ modules/mappers/mod_rewrite.c | 151 +++++++++++++++++++++++++++-------
+ 1 file changed, 123 insertions(+), 28 deletions(-)
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index a0f67a8..10a215e 100644
+--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
+@@ -168,6 +168,8 @@ static const char* really_last_key = "rewrite_really_last";
+ #define RULEFLAG_END                (1<<17)
+ #define RULEFLAG_ESCAPENOPLUS       (1<<18)
+ #define RULEFLAG_QSLAST             (1<<19)
+#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22)
+#define RULEFLAG_UNSAFE_ALLOW3F     (1<<23)
+ 
+ /* return code of the rewrite rule
+  * the result may be escaped - or not
+@@ -175,7 +177,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define ACTION_NORMAL               (1<<0)
+ #define ACTION_NOESCAPE             (1<<1)
+ #define ACTION_STATUS               (1<<2)
+-
+#define ACTION_STATUS_SET           (1<<3)
+ 
+ #define MAPTYPE_TXT                 (1<<0)
+ #define MAPTYPE_DBM                 (1<<1)
+@@ -199,6 +201,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define OPTION_IGNORE_INHERIT       (1<<8)
+ #define OPTION_IGNORE_CONTEXT_INFO  (1<<9)
+ #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10)
+#define OPTION_UNSAFE_PREFIX_STAT   (1<<12)
+ 
+ #ifndef RAND_MAX
+ #define RAND_MAX 32767
+@@ -292,6 +295,14 @@ typedef enum {
+     CONDPAT_AP_EXPR
+ } pattern_type;
+ 
+typedef enum {
+  RULE_RC_NOMATCH = 0,      /* the rule didn't match                        */
+  RULE_RC_MATCH = 1,        /* a matching rule w/ substitution              */
+  RULE_RC_NOSUB = 2,        /* a matching rule w/ no substitution           */
+  RULE_RC_STATUS_SET = 3    /* a matching rule that has set an HTTP error
+                               to be returned in r->status */
+} rule_return_type;
+
+ typedef struct {
+     char           *input;   /* Input string of RewriteCond   */
+     char           *pattern; /* the RegExp pattern string     */
+@@ -929,10 +940,15 @@ static void fully_qualify_uri(request_rec *r)
+     return;
+ }
+ 
+static int startsWith(request_rec *r, const char *haystack, const char *needle) {
+    int rc = (ap_strstr_c(haystack, needle) == haystack);
+    rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc));
+    return rc;
+}
+ /*
+- * stat() only the first segment of a path
+ * stat() only the first segment of a path, and only if it matches the output of the last matching rule
+  */
+-static int prefix_stat(const char *path, apr_pool_t *pool)
+static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub)
+ {
+     const char *curpath = path;
+     const char *root;
+@@ -966,10 +982,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool)
+         apr_finfo_t sb;
+ 
+         if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) {
+-            return 1;
+            if (!lastsub) {
+                rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath));
+                return 1;
+            }
+
+            rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ",
+                    statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT));
+            if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) {
+                return 1;
+            }
+            else {
+                const char *docroot = ap_document_root(r);
+                const char *context_docroot = ap_context_document_root(r);
+                /*
+                 * As an example, path (r->filename) is /var/foo/bar/baz.html
+                 * even if the flag is not set,  we can accept a rule that
+                 * began with a literal /var (stapath), or if the entire path
+                 * starts with the docroot or context document root
+                 */
+                if (startsWith(r, lastsub->output, statpath) ||
+                        startsWith(r, path, docroot) ||
+                        ((docroot != context_docroot) &&
+                          startsWith(r, path, context_docroot))) {
+                    return 1;
+                }
+            }
+         }
+     }
+ 
+    /* prefix will be added */
+     return 0;
+ }
+ 
+@@ -3042,6 +3084,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd,
+         else if (!strcasecmp(w, "legacyprefixdocroot")) {
+             options |= OPTION_LEGACY_PREFIX_DOCROOT;
+         }
+        else if (!strcasecmp(w, "UnsafePrefixStat")) {
+            options |= OPTION_UNSAFE_PREFIX_STAT;
+        }
+         else {
+             return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
+                                w, "'", NULL);
+@@ -3739,6 +3784,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
+             ++error;
+         }
+         break;
+    case 'u':
+    case 'U':
+        if (!strcasecmp(key, "nsafePrefixStat")){
+            cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT);
+        }
+        else if(!strcasecmp(key, "nsafeAllow3F")) {
+            cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F;
+        }
+        else {
+            ++error;
+        }
+        break;
+     default:
+         ++error;
+         break;
+@@ -4076,7 +4133,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+ /*
+  * Apply a single RewriteRule
+  */
+-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+                                           rewrite_ctx *ctx)
+ {
+     ap_regmatch_t regmatch[AP_MAX_REG_MATCH];
+     apr_array_header_t *rewriteconds;
+@@ -4127,7 +4185,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+     rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0);
+     if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||
+            (!rc &&  (p->flags & RULEFLAG_NOTMATCH))   ) ) {
+-        return 0;
+        return RULE_RC_NOMATCH;
+     }
+ 
+     /* It matched, wow! Now it's time to prepare the context structure for
+@@ -4178,7 +4236,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+             }
+         }
+         else if (!rc) {
+-            return 0;
+            return RULE_RC_NOMATCH;
+         }
+ 
+         /* If some HTTP header was involved in the condition, remember it
+@@ -4198,6 +4256,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+         newuri = do_expand(p->output, ctx, p);
+         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+                     newuri));
+        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
+            ap_strcasestr(r->unparsed_uri, "%3f") &&
+            ap_strchr_c(newuri, '?')) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
+                    "Unsafe URL with %%3f URL rewritten without "
+                    "UnsafeAllow3F");
+            r->status = HTTP_FORBIDDEN;
+            return RULE_RC_STATUS_SET;
+        }
+     }
+ 
+     /* expand [E=var:val] and [CO=<cookie>] */
+@@ -4215,7 +4282,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+             r->status = p->forced_responsecode;
+         }
+ 
+-        return 2;
+        return RULE_RC_NOSUB;
+     }
+ 
+     /* Add the previously stripped per-directory location prefix, unless
+@@ -4285,7 +4352,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     r->filename));
+ 
+         r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL);
+-        return 1;
+        return RULE_RC_MATCH;
+     }
+ 
+     /* If this rule is explicitly forced for HTTP redirection
+@@ -4300,7 +4367,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     r->filename));
+ 
+         r->status = p->forced_responsecode;
+-        return 1;
+        return RULE_RC_MATCH;
+     }
+ 
+     /* Special Rewriting Feature: Self-Reduction
+@@ -4322,7 +4389,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     "with %s", p->forced_responsecode, r->filename));
+ 
+         r->status = p->forced_responsecode;
+-        return 1;
+        return RULE_RC_MATCH;
+     }
+ 
+     /* Finally remember the forced mime-type */
+@@ -4331,7 +4398,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+     /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_)
+      * But now we're done for this particular rule.
+      */
+-    return 1;
+    return RULE_RC_MATCH;
+ }
+ 
+ /*
+@@ -4339,13 +4406,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+  * i.e. a list of rewrite rules
+  */
+ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+-                              char *perdir)
+                              char *perdir, rewriterule_entry **lastsub)
+ {
+     rewriterule_entry *entries;
+     rewriterule_entry *p;
+     int i;
+     int changed;
+-    int rc;
+    rule_return_type rc;
+     int s;
+     rewrite_ctx *ctx;
+     int round = 1;
+@@ -4353,6 +4420,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+     ctx = apr_palloc(r->pool, sizeof(*ctx));
+     ctx->perdir = perdir;
+     ctx->r = r;
+    *lastsub = NULL;
+ 
+     /*
+      *  Iterate over all existing rules
+@@ -4380,7 +4448,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+         ctx->vary = NULL;
+         rc = apply_rewrite_rule(p, ctx);
+ 
+-        if (rc) {
+        if (rc != RULE_RC_NOMATCH) {
+
+            if (!(p->flags & RULEFLAG_NOSUB)) {
+                rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output));
+                *lastsub = p;
+            }
+ 
+             /* Catch looping rules with pathinfo growing unbounded */
+             if ( strlen( r->filename ) > 2*r->server->limit_req_line ) {
+@@ -4400,6 +4473,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+                 apr_table_merge(r->headers_out, "Vary", ctx->vary);
+             }
+ 
+
+            /* Error while evaluating rule, r->status set */
+            if (RULE_RC_STATUS_SET == rc) {
+                return ACTION_STATUS_SET;
+            }
+
+             /*
+              * The rule sets the response code (implies match-only)
+              */
+@@ -4410,7 +4489,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+             /*
+              * Indicate a change if this was not a match-only rule.
+              */
+-            if (rc != 2) {
+            if (rc != RULE_RC_NOSUB) {
+                 changed = ((p->flags & RULEFLAG_NOESCAPE)
+                            ? ACTION_NOESCAPE : ACTION_NORMAL);
+             }
+@@ -4602,6 +4681,7 @@ static int hook_uri2file(request_rec *r)
+     int rulestatus;
+     void *skipdata;
+     const char *oargs;
+    rewriterule_entry *lastsub = NULL;
+ 
+     /*
+      *  retrieve the config structures
+@@ -4713,7 +4793,7 @@ static int hook_uri2file(request_rec *r)
+         /*
+          *  now apply the rules ...
+          */
+-        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL);
+        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub);
+         apr_table_setn(r->notes, "mod_rewrite_rewritten",
+                        apr_psprintf(r->pool,"%d",rulestatus));
+     }
+@@ -4745,6 +4825,9 @@ static int hook_uri2file(request_rec *r)
+             r->status = HTTP_OK;
+             return n;
+         }
+        else if (ACTION_STATUS_SET == rulestatus) {
+            return r->status;
+        }
+ 
+         flen = r->filename ? strlen(r->filename) : 0;
+         if (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0) {
+@@ -4865,23 +4948,29 @@ static int hook_uri2file(request_rec *r)
+                 return HTTP_BAD_REQUEST;
+             }
+ 
+-            /* if there is no valid prefix, we call
+-             * the translator from the core and
+-             * prefix the filename with document_root
+            /* We have r->filename as a path in a server-context rewrite without
+             * the PT flag. The historical behavior is to treat it as a verbatim
+             * filesystem path iff the first component of the path exists and is
+             * readable by httpd. Otherwise, it is interpreted as DocumentRoot
+             * relative.
+              *
+              * NOTICE:
+              * We cannot leave out the prefix_stat because
+-             * - when we always prefix with document_root
+-             *   then no absolute path can be created, e.g. via
+-             *   emulating a ScriptAlias directive, etc.
+-             * - when we always NOT prefix with document_root
+             * - If we always prefix with document_root
+             *   then no absolute path can could ever be used in
+             *   a substitution. e.g. emulating an Alias.
+             * - If we never prefix with document_root
+              *   then the files under document_root have to
+              *   be references directly and document_root
+              *   gets never used and will be a dummy parameter -
+-             *   this is also bad
+             *   this is also bad.
+             *   - Later addition: This part is questionable.
+             *     If we had never prefixed, users would just 
+             *     need %{DOCUMENT_ROOT} in substitutions or the 
+             *     [PT] flag.
+              *
+              * BUT:
+-             * Under real Unix systems this is no problem,
+             * Under real Unix systems this is no perf problem,
+              * because we only do stat() on the first directory
+              * and this gets cached by the kernel for along time!
+              */
+@@ -4890,7 +4979,9 @@ static int hook_uri2file(request_rec *r)
+                 uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced");
+             }
+ 
+-            if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) {
+            if (!prefix_stat(r, r->filename, r->pool,
+                             conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub)
+                || uri_reduced != NULL) {
+                 int res;
+                 char *tmp = r->uri;
+ 
+@@ -4935,6 +5026,7 @@ static int hook_fixup(request_rec *r)
+     char *ofilename, *oargs;
+     int is_proxyreq;
+     void *skipdata;
+    rewriterule_entry *lastsub;
+ 
+     dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config,
+                                                         &rewrite_module);
+@@ -5019,7 +5111,7 @@ static int hook_fixup(request_rec *r)
+     /*
+      *  now apply the rules ...
+      */
+-    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
+    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub);
+     if (rulestatus) {
+         unsigned skip;
+ 
+@@ -5040,6 +5132,9 @@ static int hook_fixup(request_rec *r)
+             r->status = HTTP_OK;
+             return n;
+         }
+        else if (ACTION_STATUS_SET == rulestatus) {
+            return r->status;
+        }
+ 
+         l = strlen(r->filename);
+         if (l > 6 && strncmp(r->filename, "proxy:", 6) == 0) {
+-- 
+2.33.0
+
--- a/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch
+++ b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch
@ -0,0 +1,364 @@
+From 554554b0ebb14d6578adb70a389c57a0d5f18a3b Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 24 Jun 2024 17:54:34 +0000
+Subject: [PATCH] Merge r1918551 from trunk:
+
+add ap_set_content_type_ex to differentiate
+
+trusted sources
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918560 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/554554b0ebb14d6578adb70a389c57a0d5f18a3b
+
+---
+ include/http_protocol.h           | 11 +++++++
+ include/httpd.h                   | 54 +++++++++++++++++++++++++++++++
+ modules/http/http_protocol.c      |  6 ++++
+ modules/http/mod_mime.c           | 20 ++++++------
+ modules/mappers/mod_actions.c     |  6 ++--
+ modules/mappers/mod_negotiation.c |  8 ++---
+ modules/mappers/mod_rewrite.c     |  2 +-
+ modules/metadata/mod_headers.c    |  6 ++--
+ modules/metadata/mod_mime_magic.c |  4 +--
+ server/config.c                   |  2 +-
+ server/core.c                     |  2 +-
+ 11 files changed, 97 insertions(+), 24 deletions(-)
+
+diff --git a/include/http_protocol.h b/include/http_protocol.h
+index 0468d75..a1bb1a3 100644
+--- a/include/http_protocol.h
+++ b/include/http_protocol.h
+@@ -381,6 +381,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l);
+  */
+ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct);
+ 
+/**
+ * Set the content type for this request (r->content_type).
+ * @param r The current request
+ * @param ct The new content type
+ * @param trusted If non-zero, The content-type should come from a
+ *        trusted source such as server configuration rather
+ *        than application output.
+ * for the AddOutputFilterByType directive to work correctly.
+ */
+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted);
+
+ /**
+  * Set the Accept-Ranges header for this response
+  * @param r The current request
+diff --git a/include/httpd.h b/include/httpd.h
+index acb4c5f..67197d7 100644
+--- a/include/httpd.h
+++ b/include/httpd.h
+@@ -645,6 +645,49 @@ struct ap_method_list_t {
+     /** the array used for extension methods */
+     apr_array_header_t *method_list;
+ };
+/** @} */
+
+/**
+ * @defgroup bnotes Binary notes recognized by the server
+ * @ingroup APACHE_CORE_DAEMON
+ * @{
+ *
+ * @brief Binary notes recognized by the server.
+ */
+
+/**
+ * The type used for request binary notes.
+ */
+typedef apr_uint64_t ap_request_bnotes_t;
+
+/**
+ * These constants represent bitmasks for notes associated with this
+ * request. There are space for 64 bits in the apr_uint64_t.
+ *
+ */
+#define AP_REQUEST_STRONG_ETAG 1 >> 0
+#define AP_REQUEST_TRUSTED_CT  1 << 1
+
+/**
+ * This is a convenience macro to ease with getting specific request
+ * binary notes.
+ */
+#define AP_REQUEST_GET_BNOTE(r, mask) \
+    ((mask) & ((r)->bnotes))
+
+/**
+ * This is a convenience macro to ease with setting specific request
+ * binary notes.
+ */
+#define AP_REQUEST_SET_BNOTE(r, mask, val) \
+    (r)->bnotes = (((r)->bnotes & ~(mask)) | (val))
+
+/**
+ * Returns true if the strong etag flag is set for this request.
+ */
+#define AP_REQUEST_IS_STRONG_ETAG(r) \
+        AP_REQUEST_GET_BNOTE((r), AP_REQUEST_STRONG_ETAG)
+/** @} */
+ 
+ /**
+  * @defgroup module_magic Module Magic mime types
+@@ -715,6 +758,12 @@ struct ap_method_list_t {
+ 
+ /** @} // values_request_rec_used_path_info */
+ 
+/**
+ * Returns true if the content-type field is from a trusted source
+ */
+#define AP_REQUEST_IS_TRUSTED_CT(r) \
+    (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT))
+/** @} */
+ 
+ /*
+  * Things which may vary per file-lookup WITHIN a request ---
+@@ -1062,6 +1111,11 @@ struct request_rec {
+      *  1 yes/success
+      */
+     int double_reverse;
+    /** Request flags associated with this request. Use
+     * AP_REQUEST_GET_FLAGS() and AP_REQUEST_SET_FLAGS() to access
+     * the elements of this field.
+     */
+    ap_request_bnotes_t bnotes;
+ };
+ 
+ /**
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index 6e0301a..c22c90b 100644
+--- a/modules/http/http_protocol.c
+++ b/modules/http/http_protocol.c
+@@ -1076,8 +1076,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct)
+     }
+     else if (!r->content_type || strcmp(r->content_type, ct)) {
+         r->content_type = ct;
+        AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0);
+     }
+ }
+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted)
+{
+    ap_set_content_type(r, ct);
+    AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0);
+}
+ 
+ AP_DECLARE(void) ap_set_accept_ranges(request_rec *r)
+ {
+diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c
+index 03d1c41..1bf531d 100644
+--- a/modules/http/mod_mime.c
+++ b/modules/http/mod_mime.c
+@@ -759,7 +759,7 @@ static int find_ct(request_rec *r)
+     int found_metadata = 0;
+ 
+     if (r->finfo.filetype == APR_DIR) {
+-        ap_set_content_type(r, DIR_MAGIC_TYPE);
+        ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1);
+         return OK;
+     }
+ 
+@@ -837,7 +837,7 @@ static int find_ct(request_rec *r)
+         if (exinfo == NULL || !exinfo->forced_type) {
+             if ((type = apr_hash_get(mime_type_extensions, ext,
+                                      APR_HASH_KEY_STRING)) != NULL) {
+-                ap_set_content_type(r, (char*) type);
+                ap_set_content_type_ex(r, (char*) type, 1);
+                 found = 1;
+             }
+         }
+@@ -846,7 +846,7 @@ static int find_ct(request_rec *r)
+ 
+             /* empty string is treated as special case for RemoveType */
+             if (exinfo->forced_type && *exinfo->forced_type) {
+-                ap_set_content_type(r, exinfo->forced_type);
+                ap_set_content_type_ex(r, exinfo->forced_type, 1);
+                 found = 1;
+             }
+ 
+@@ -951,33 +951,33 @@ static int find_ct(request_rec *r)
+             memcpy(tmp, ctp->subtype, ctp->subtype_len);
+             tmp += ctp->subtype_len;
+             *tmp = 0;
+-            ap_set_content_type(r, base_content_type);
+            ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+             while (pp != NULL) {
+                 if (charset && !strcmp(pp->attr, "charset")) {
+                     if (!override) {
+-                        ap_set_content_type(r,
+                        ap_set_content_type_ex(r,
+                                             apr_pstrcat(r->pool,
+                                                         r->content_type,
+                                                         "; charset=",
+                                                         charset,
+-                                                        NULL));
+                                                        NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+                         override = 1;
+                     }
+                 }
+                 else {
+-                    ap_set_content_type(r,
+                    ap_set_content_type_ex(r,
+                                         apr_pstrcat(r->pool,
+                                                     r->content_type,
+                                                     "; ", pp->attr,
+                                                     "=", pp->val,
+-                                                    NULL));
+                                                    NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+                 }
+                 pp = pp->next;
+             }
+             if (charset && !override) {
+-                ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type,
+                ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type,
+                                                    "; charset=", charset,
+-                                                   NULL));
+                                                   NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+             }
+         }
+     }
+diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c
+index ac9c3b7..5e398b5 100644
+--- a/modules/mappers/mod_actions.c
+++ b/modules/mappers/mod_actions.c
+@@ -182,8 +182,10 @@ static int action_handler(request_rec *r)
+         return DECLINED;
+ 
+     /* Second, check for actions (which override the method scripts) */
+-    action = r->handler ? r->handler :
+-        ap_field_noparam(r->pool, r->content_type);
+    action = r->handler;
+    if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) {
+        action = ap_field_noparam(r->pool, r->content_type);
+    }
+ 
+     if (action && (t = apr_table_get(conf->action_types, action))) {
+         int virtual = (*t++ == '0' ? 0 : 1);
+diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c
+index b6dfedc..eab08e0 100644
+--- a/modules/mappers/mod_negotiation.c
+++ b/modules/mappers/mod_negotiation.c
+@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg)
+          * might be doing.
+          */
+         if (sub_req->handler && !sub_req->content_type) {
+-            ap_set_content_type(sub_req, CGI_MAGIC_TYPE);
+            ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1);
+         }
+ 
+         /*
+@@ -3005,14 +3005,14 @@ static int handle_map_file(request_rec *r)
+         /* set MIME type and charset as negotiated */
+         if (best->mime_type && *best->mime_type) {
+             if (best->content_charset && *best->content_charset) {
+-                ap_set_content_type(r, apr_pstrcat(r->pool,
+                ap_set_content_type_ex(r, apr_pstrcat(r->pool,
+                                                    best->mime_type,
+                                                    "; charset=",
+                                                    best->content_charset,
+-                                                   NULL));
+                                                   NULL), 1);
+             }
+             else {
+-                ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type));
+                ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1);
+             }
+         }
+ 
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 10a215e..3603150 100644
+--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
+@@ -5375,7 +5375,7 @@ static int hook_mimetype(request_rec *r)
+         rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'",
+                     r->filename, t));
+ 
+-        ap_set_content_type(r, t);
+        ap_set_content_type_ex(r, t, 1);
+     }
+ 
+     /* handler */
+diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c
+index 82d0045..be8fbb2 100644
+--- a/modules/metadata/mod_headers.c
+++ b/modules/metadata/mod_headers.c
+@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+             break;
+         case hdr_set:
+             if (!strcasecmp(hdr->header, "Content-Type")) {
+-                 ap_set_content_type(r, process_tags(hdr, r));
+                 ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+             }
+             apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+             break;
+         case hdr_setifempty:
+             if (NULL == apr_table_get(headers, hdr->header)) {
+                 if (!strcasecmp(hdr->header, "Content-Type")) {
+-                    ap_set_content_type(r, process_tags(hdr, r));
+                    ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+                 }
+                 apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+             }
+@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+                 const char *repl = process_regexp(hdr, r->content_type, r);
+                 if (repl == NULL)
+                     return 0;
+-                ap_set_content_type(r, repl);
+                ap_set_content_type_ex(r, repl, 1);
+             }
+             if (apr_table_get(headers, hdr->header)) {
+                 edit_do ed;
+diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c
+index 3ecb3c0..b828c2f 100644
+--- a/modules/metadata/mod_mime_magic.c
+++ b/modules/metadata/mod_mime_magic.c
+@@ -788,7 +788,7 @@ static int magic_rsl_to_request(request_rec *r)
+     /* XXX: this could be done at config time I'm sure... but I'm
+      * confused by all this magic_rsl stuff. -djg */
+     ap_content_type_tolower(tmp);
+-    ap_set_content_type(r, tmp);
+    ap_set_content_type_ex(r, tmp, 1);
+ 
+     if (state == rsl_encoding) {
+         tmp = rsl_strdup(r, encoding_frag,
+@@ -2325,7 +2325,7 @@ static int revision_suffix(request_rec *r)
+ 
+     /* extract content type/encoding/language from sub-request */
+     if (sub->content_type) {
+-        ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type));
+        ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1);
+ #if MIME_MAGIC_DEBUG
+         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557)
+                     MODNAME ": subrequest %s got %s",
+diff --git a/server/config.c b/server/config.c
+index 0380cbe..bc8ec54 100644
+--- a/server/config.c
+++ b/server/config.c
+@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r)
+     }
+ 
+     if (!r->handler) {
+-        if (r->content_type) {
+        if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) {
+             handler = r->content_type;
+             if ((p=ap_strchr_c(handler, ';')) != NULL) {
+                 char *new_handler = (char *)apr_pmemdup(r->pool, handler,
+diff --git a/server/core.c b/server/core.c
+index c6e032c..edd3c0f 100644
+--- a/server/core.c
+++ b/server/core.c
+@@ -4775,7 +4775,7 @@ static int core_override_type(request_rec *r)
+     /* Check for overrides with ForceType / SetHandler
+      */
+     if (conf->mime_type && strcmp(conf->mime_type, "none"))
+-        ap_set_content_type(r, (char*) conf->mime_type);
+        ap_set_content_type_ex(r, (char*) conf->mime_type, 1);
+ 
+     if (conf->expr_handler) { 
+         const char *err;
+-- 
+2.27.0
+
--- a/backport-CVE-2024-38477-validate-hostsname.patch
+++ b/backport-CVE-2024-38477-validate-hostsname.patch
@ -0,0 +1,50 @@
+From 1d98d4db186e708f059336fb9342d0adb6925e85 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 25 Jun 2024 17:29:32 +0000
+Subject: [PATCH] Merge r1918606 from trunk:
+
+validate hostname
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918607 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/1d98d4db186e708f059336fb9342d0adb6925e85
+
+---
+ modules/proxy/proxy_util.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 79e12fc..a9c21ad 100644
+--- a/modules/proxy/proxy_util.c
+++ b/modules/proxy/proxy_util.c
+@@ -2427,6 +2427,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r,
+                              apr_pstrcat(p,"URI cannot be parsed: ", *url,
+                                          NULL));
+     }
+
+    if (!uri->hostname) {
+        return ap_proxyerror(r, HTTP_BAD_REQUEST,
+                             apr_pstrcat(p,"URI has no hostname: ", *url,
+                                         NULL));
+    }
+
+     if (!uri->port) {
+         uri->port = ap_proxy_port_of_scheme(uri->scheme);
+     }
+@@ -3749,6 +3756,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+      * way. No telling which legacy backend is relying no this.
+      */
+     if (dconf->preserve_host == 0) {
+        if (!uri->hostname) {
+            rc = HTTP_BAD_REQUEST;
+            goto cleanup;
+        }
+         if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
+             if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
+                 buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:",
+-- 
+2.33.0
+
--- a/backport-CVE-2024-39884-maintain-trusted-flag.patch
+++ b/backport-CVE-2024-39884-maintain-trusted-flag.patch
@ -0,0 +1,309 @@
+From fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 2 Jul 2024 13:07:17 +0000
+Subject: [PATCH] Merge r1918795, r1918814 from trunk:
+
+maintain trusted flag
+
+
+* Always trust content types that we set literally
+
+Submitted by: covener, rpluem
+Reviewed by: covener, jorton, rpluem
+
+Github: closes #459
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918839 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d
+
+---
+ modules/cluster/mod_heartmonitor.c   |  2 +-
+ modules/dav/main/mod_dav.c           | 10 +++++-----
+ modules/examples/mod_example_hooks.c |  2 +-
+ modules/filters/mod_data.c           |  2 +-
+ modules/filters/mod_include.c        |  2 +-
+ modules/filters/mod_proxy_html.c     |  4 ++--
+ modules/generators/mod_cgi.c         |  2 +-
+ modules/generators/mod_cgid.c        |  2 +-
+ modules/generators/mod_info.c        |  2 +-
+ modules/generators/mod_status.c      |  4 ++--
+ modules/http/http_filters.c          |  2 +-
+ modules/http/http_protocol.c         |  4 ++--
+ modules/http/http_request.c          |  2 +-
+ modules/ldap/util_ldap.c             |  2 +-
+ modules/mappers/mod_imagemap.c       |  2 +-
+ modules/proxy/mod_proxy_balancer.c   |  2 +-
+ 16 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c
+index 61a8517..283981d 100644
+--- a/modules/cluster/mod_heartmonitor.c
+++ b/modules/cluster/mod_heartmonitor.c
+@@ -780,7 +780,7 @@ static int hm_handler(request_rec *r)
+     hmserver.seen = apr_time_now();
+     hm_update_stat(ctx, &hmserver, r->pool);
+ 
+-    ap_set_content_type(r, "text/plain");
+    ap_set_content_type_ex(r, "text/plain", 1);
+     ap_set_content_length(r, 2);
+     ap_rputs("OK", r);
+     ap_rflush(r);
+diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c
+index eb8af77..0ebc515 100644
+--- a/modules/dav/main/mod_dav.c
+++ b/modules/dav/main/mod_dav.c
+@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
+     r->status = status;
+     r->status_line = ap_get_status_line(status);
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     /* begin the response now... */
+     ap_rvputs(r,
+@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r,
+ {
+     r->status = err->status;
+ 
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     ap_rputs(DAV_XML_HEADER DEBUG_CR
+              "<D:error xmlns:D=\"DAV:\"", r);
+@@ -512,7 +512,7 @@ DAV_DECLARE(void) dav_begin_multistatus(apr_bucket_brigade *bb,
+ {
+     /* Set the correct status and Content-Type */
+     r->status = status;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     /* Send the headers and actual multistatus response now... */
+     ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR
+@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r)
+ 
+     /* send the options response */
+     r->status = HTTP_OK;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     /* send the headers and response body */
+     ap_rputs(DAV_XML_HEADER DEBUG_CR
+@@ -3192,7 +3192,7 @@ static int dav_method_lock(request_rec *r)
+     (*locks_hooks->close_lockdb)(lockdb);
+ 
+     r->status = HTTP_OK;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     ap_rputs(DAV_XML_HEADER DEBUG_CR "<D:prop xmlns:D=\"DAV:\">" DEBUG_CR, r);
+     if (lock == NULL)
+diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c
+index d818dc1..4d79b86 100644
+--- a/modules/examples/mod_example_hooks.c
+++ b/modules/examples/mod_example_hooks.c
+@@ -993,7 +993,7 @@ static int x_handler(request_rec *r)
+      * Set the Content-type header. Note that we do not actually have to send
+      * the headers: this is done by the http core.
+      */
+-    ap_set_content_type(r, "text/html");
+    ap_set_content_type_ex(r, "text/html", 1);
+     /*
+      * If we're only supposed to send header information (HEAD request), we're
+      * already there.
+diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c
+index d083d32..489e76c 100644
+--- a/modules/filters/mod_data.c
+++ b/modules/filters/mod_data.c
+@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+             }
+         }
+ 
+-        ap_set_content_type(r, "text/plain");
+        ap_set_content_type_ex(r, "text/plain", 1);
+ 
+     }
+ 
+diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
+index a46a944..05f994c 100644
+--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
+@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r)
+     if (r->handler && (strcmp(r->handler, "server-parsed") == 0))
+     {
+         if (!r->content_type || !*r->content_type) {
+-            ap_set_content_type(r, "text/html");
+            ap_set_content_type_ex(r, "text/html", 1);
+         }
+         r->handler = "default-handler";
+     }
+diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
+index 25eb395..ce45878 100644
+--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
+@@ -952,7 +952,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+                         ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422)
+                                       "No i18n support found.  Install mod_xml2enc if required");
+                     enc = XML_CHAR_ENCODING_NONE;
+-                    ap_set_content_type(f->r, "text/html;charset=utf-8");
+                    ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+                 }
+                 else {
+                     /* if we wanted a non-default charset_out, insert the
+@@ -968,7 +968,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+                                                         cenc, NULL));
+                     }
+                     else /* Normal case, everything worked, utf-8 output */
+-                        ap_set_content_type(f->r, "text/html;charset=utf-8");
+                        ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+                 }
+ 
+                 ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype);
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 96bb883..9537cc5 100644
+--- a/modules/generators/mod_cgi.c
+++ b/modules/generators/mod_cgi.c
+@@ -1080,7 +1080,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+     /* Force sub_req to be treated as a CGI request, even if ordinary
+      * typing rules would have called it something else.
+      */
+-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
+    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+ 
+     /* Run it. */
+     rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index 1a67779..43ee691 100644
+--- a/modules/generators/mod_cgid.c
+++ b/modules/generators/mod_cgid.c
+@@ -1758,7 +1758,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+     /* Force sub_req to be treated as a CGI request, even if ordinary
+      * typing rules would have called it something else.
+      */
+-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
+    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+ 
+     /* Run it. */
+     rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c
+index e7af783..78106cd 100644
+--- a/modules/generators/mod_info.c
+++ b/modules/generators/mod_info.c
+@@ -777,7 +777,7 @@ static int display_info(request_rec * r)
+         return DECLINED;
+     }
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     ap_rputs(DOCTYPE_XHTML_1_0T
+              "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n"
+diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
+index 5917953..b1d82cb 100644
+--- a/modules/generators/mod_status.c
+++ b/modules/generators/mod_status.c
+@@ -269,7 +269,7 @@ static int status_handler(request_rec *r)
+     if (r->method_number != M_GET)
+         return DECLINED;
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     /*
+      * Simple table-driven form data set parser that lets you alter the header
+@@ -297,7 +297,7 @@ static int status_handler(request_rec *r)
+                     no_table_report = 1;
+                     break;
+                 case STAT_OPT_AUTO:
+-                    ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
+                    ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1);
+                     short_report = 1;
+                     break;
+                 }
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index 4073fc9..fd29a24 100644
+--- a/modules/http/http_filters.c
+++ b/modules/http/http_filters.c
+@@ -1256,7 +1256,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r)
+         }
+     }
+ 
+-    ap_set_content_type(r, "message/http");
+    ap_set_content_type_ex(r, "message/http", 1);
+ 
+     /* Now we recreate the request, and echo it back */
+ 
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index c22c90b..dc17608 100644
+--- a/modules/http/http_protocol.c
+++ b/modules/http/http_protocol.c
+@@ -1422,10 +1422,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error)
+             request_conf->suppress_charset = 1; /* avoid adding default
+                                                  * charset later
+                                                  */
+-            ap_set_content_type(r, "text/html");
+            ap_set_content_type_ex(r, "text/html", 1);
+         }
+         else {
+-            ap_set_content_type(r, "text/html; charset=iso-8859-1");
+            ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1);
+         }
+ 
+         if ((status == HTTP_METHOD_NOT_ALLOWED)
+diff --git a/modules/http/http_request.c b/modules/http/http_request.c
+index d59cfe2..71ecc2b 100644
+--- a/modules/http/http_request.c
+++ b/modules/http/http_request.c
+@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
+     r->args = rr->args;
+     r->finfo = rr->finfo;
+     r->handler = rr->handler;
+-    ap_set_content_type(r, rr->content_type);
+    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+     r->content_encoding = rr->content_encoding;
+     r->content_languages = rr->content_languages;
+     r->per_dir_config = rr->per_dir_config;
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index 16bcc3d..0c0414f 100644
+--- a/modules/ldap/util_ldap.c
+++ b/modules/ldap/util_ldap.c
+@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r)
+     st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,
+             &ldap_module);
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     if (r->header_only)
+         return OK;
+diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c
+index 187a500..3e14933 100644
+--- a/modules/mappers/mod_imagemap.c
+++ b/modules/mappers/mod_imagemap.c
+@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect)
+ 
+ static void menu_header(request_rec *r, char *menu)
+ {
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     ap_rvputs(r, DOCTYPE_HTML_3_2, "<html><head>\n<title>Menu for ",
+               ap_escape_html(r->pool, r->uri),
+diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
+index f235f4a..67aa081 100644
+--- a/modules/proxy/mod_proxy_balancer.c
+++ b/modules/proxy/mod_proxy_balancer.c
+@@ -1506,7 +1506,7 @@ static int balancer_handler(request_rec *r)
+ 
+     if (apr_table_get(params, "xml")) {
+         char date[APR_RFC822_DATE_LEN];
+-        ap_set_content_type(r, "text/xml");
+        ap_set_content_type_ex(r, "text/xml", 1);
+         ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r);
+         ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r);
+         ap_rputs("  <httpd:balancers>\n", r);
+-- 
+2.33.0
+
--- a/backport-CVE-2024-40725.patch
+++ b/backport-CVE-2024-40725.patch
@ -0,0 +1,29 @@
+From a7d24b4ea9a6ea35878fd33075365328caafcf91 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 15 Jul 2024 12:08:30 +0000
+Subject: [PATCH] Merge r1919247 from trunk:
+
+copy the trusted flag from the subrequest
+
+Submitted By: covener
+Reviewed By: covener, ylavic, gbechis
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1919249 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/http/http_request.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/http/http_request.c b/modules/http/http_request.c
+index 71ecc2bbab1..7e9477be1f1 100644
+--- a/modules/http/http_request.c
+++ b/modules/http/http_request.c
+@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
+     r->args = rr->args;
+     r->finfo = rr->finfo;
+     r->handler = rr->handler;
+-    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(rr));
+     r->content_encoding = rr->content_encoding;
+     r->content_languages = rr->content_languages;
+     r->per_dir_config = rr->per_dir_config;
--- a/backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch
+++ b/backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch
@ -0,0 +1,74 @@
+From 8fe3cc79d1bcb4a20a0c56853d82e85c8a88b8f5 Mon Sep 17 00:00:00 2001
+From: Graham Leggett <minfrin@apache.org>
+Date: Mon, 20 Nov 2023 13:17:25 +0000
+Subject: [PATCH] Backport to v2.4:
+
+   *) core: Fix use after free warning with gcc -fanalyzer.
+      trunk patch: http://svn.apache.org/r1892413
+      2.4.x patch: https://svn.apache.org/repos/asf/httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch
+      +1: minfrin, ylavic, jorton
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913983 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:The changelog contains context adaptation and does not contain the STATUS file
+Reference:https://github.com/apache/httpd/commit/8fe3cc79d1bcb4a20a0c56853d82e85c8a88b8f5
+
+---
+ CHANGES           |  2 ++
+ server/mpm_unix.c | 16 ++++++++++------
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/CHANGES b/CHANGES
+index f3f52fd..906667a 100644
+--- a/CHANGES
+++ b/CHANGES
+@@ -3,6 +3,8 @@ Changes with Apache 2.4.59
+ 
+   *) mod_ssl: release memory to the OS when needed. [Giovanni Bechis]
+ 
+  *) core: Fix use after free warning with gcc -fanalyzer. [Joe Orton]
+
+ Changes with Apache 2.4.43
+ 
+   *) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
+diff --git a/server/mpm_unix.c b/server/mpm_unix.c
+index 775fe5f..9c5f45b 100644
+--- a/server/mpm_unix.c
+++ b/server/mpm_unix.c
+@@ -259,10 +259,12 @@ AP_DECLARE(void) ap_reclaim_child_processes(int terminate,
+         while (cur_extra) {
+             ap_generation_t old_gen;
+             extra_process_t *next = cur_extra->next;
+            pid_t pid = cur_extra->pid;
+ 
+-            if (reclaim_one_pid(cur_extra->pid, action_table[cur_action].action)) {
+-                if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) {
+-                    mpm_callback(-1, cur_extra->pid, old_gen);
+            if (reclaim_one_pid(pid, action_table[cur_action].action)) {
+                if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) {
+                    /* cur_extra dangling pointer from here. */
+                    mpm_callback(-1, pid, old_gen);
+                 }
+                 else {
+                     AP_DEBUG_ASSERT(1 == 0);
+@@ -307,10 +309,12 @@ AP_DECLARE(void) ap_relieve_child_processes(ap_reclaim_callback_fn_t *mpm_callba
+     while (cur_extra) {
+         ap_generation_t old_gen;
+         extra_process_t *next = cur_extra->next;
+        pid_t pid = cur_extra->pid;
+ 
+-        if (reclaim_one_pid(cur_extra->pid, DO_NOTHING)) {
+-            if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) {
+-                mpm_callback(-1, cur_extra->pid, old_gen);
+        if (reclaim_one_pid(pid, DO_NOTHING)) {
+            if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) {
+                /* cur_extra dangling pointer from here. */
+                mpm_callback(-1, pid, old_gen);
+             }
+             else {
+                 AP_DEBUG_ASSERT(1 == 0);
+-- 
+2.33.0
+
--- a/backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch
+++ b/backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch
@ -0,0 +1,55 @@
+From 32881a76e31f8bafa498999bae5237c3a6418317 Mon Sep 17 00:00:00 2001
+From: Jean-Frederic Clere <jfclere@apache.org>
+Date: Wed, 14 Feb 2024 14:27:03 +0000
+Subject: [PATCH] * mod_slotmem_shm: Use ap_os_is_path_absolute() to make it
+ portable.
+
+Reviewed by: jfclere, jorton, covener
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1915791 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/32881a76e31f8bafa498999bae5237c3a6418317
+
+---
+ changes-entries/mod_slotmem_shm.txt | 3 +++
+ modules/slotmem/mod_slotmem_shm.c   | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+ create mode 100644 changes-entries/mod_slotmem_shm.txt
+
+diff --git a/changes-entries/mod_slotmem_shm.txt b/changes-entries/mod_slotmem_shm.txt
+new file mode 100644
+index 0000000..767711f
+--- /dev/null
+++ b/changes-entries/mod_slotmem_shm.txt
+@@ -0,0 +1,3 @@
+   *) mod_slotmem_shm: Use ap_os_is_path_absolute() to make it portable.
+      [Jean-Frederic Clere]
+
+diff --git a/modules/slotmem/mod_slotmem_shm.c b/modules/slotmem/mod_slotmem_shm.c
+index f4eaa84..4d14faf 100644
+--- a/modules/slotmem/mod_slotmem_shm.c
+++ b/modules/slotmem/mod_slotmem_shm.c
+@@ -92,7 +92,7 @@ static int slotmem_filenames(apr_pool_t *pool,
+     const char *fname = NULL, *pname = NULL;
+ 
+     if (slotname && *slotname && strcasecmp(slotname, "none") != 0) {
+-        if (slotname[0] != '/') {
+        if (!ap_os_is_path_absolute(pool, slotname)) {
+             /* Each generation needs its own file name. */
+             int generation = 0;
+             ap_mpm_query(AP_MPMQ_GENERATION, &generation);
+@@ -109,7 +109,7 @@ static int slotmem_filenames(apr_pool_t *pool,
+ 
+         if (persistname) {
+             /* Persisted file names are immutable... */
+-            if (slotname[0] != '/') {
+            if (!ap_os_is_path_absolute(pool, slotname)) {
+                 pname = apr_pstrcat(pool, DEFAULT_SLOTMEM_PREFIX,
+                                     slotname, DEFAULT_SLOTMEM_SUFFIX,
+                                     DEFAULT_SLOTMEM_PERSIST_SUFFIX,
+-- 
+2.33.0
+
--- a/backport-release-memory-to-the-OS-when-needed.patch
+++ b/backport-release-memory-to-the-OS-when-needed.patch
@ -0,0 +1,101 @@
+From 80560d29c8bc6dac44c8a7f7767e54e0ec52c5e6 Mon Sep 17 00:00:00 2001
+From: Graham Leggett <minfrin@apache.org>
+Date: Sat, 18 Nov 2023 11:20:14 +0000
+Subject: [PATCH] Backport to v2.4:
+
+  *) mod_ssl: release memory to the OS when needed
+     Trunk version of patch:
+       https://svn.apache.org/r1898410
+       https://svn.apache.org/r1898366
+        svn merge -c 1898366 ^/httpd/httpd/trunk .
+        svn merge -c 1898410 ^/httpd/httpd/trunk .
+     +1: gbechis, ylavic, jorton
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913909 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:The changelog contains context adaptation and does not contain the STATUS file
+Reference:https://github.com/apache/httpd/commit/80560d29c8bc6dac44c8a7f7767e54e0ec52c5e6
+
+---
+ CHANGES                         | 4 ++++
+ modules/ssl/ssl_engine_init.c   | 7 ++++++-
+ modules/ssl/ssl_util_ocsp.c     | 5 ++++-
+ modules/ssl/ssl_util_stapling.c | 4 +++-
+ 4 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/CHANGES b/CHANGES
+index 0a351d1..f3f52fd 100644
+--- a/CHANGES
+++ b/CHANGES
+@@ -1,4 +1,8 @@
+                                                          -*- coding: utf-8 -*-
+Changes with Apache 2.4.59
+
+  *) mod_ssl: release memory to the OS when needed. [Giovanni Bechis]
+
+ Changes with Apache 2.4.43
+ 
+   *) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 1c5ca97..7809e9d 100644
+--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
+@@ -1679,6 +1679,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02208)
+                      "SSL proxy client cert initialization failed");
+         ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+        sk_X509_INFO_free(sk);
+         return ssl_die(s);
+     }
+ 
+@@ -1688,7 +1689,11 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+         int i;
+ 
+         X509_INFO *inf = sk_X509_INFO_value(pkp->certs, n);
+-        X509_STORE_CTX_init(sctx, store, inf->x509, NULL);
+        if (!X509_STORE_CTX_init(sctx, store, inf->x509, NULL)) {
+            sk_X509_INFO_free(sk);
+            X509_STORE_CTX_free(sctx);
+            return ssl_die(s);
+        }
+ 
+         /* Attempt to verify the client cert */
+         if (X509_verify_cert(sctx) != 1) {
+diff --git a/modules/ssl/ssl_util_ocsp.c b/modules/ssl/ssl_util_ocsp.c
+index b66e151..0c141e6 100644
+--- a/modules/ssl/ssl_util_ocsp.c
+++ b/modules/ssl/ssl_util_ocsp.c
+@@ -369,8 +369,11 @@ static STACK_OF(X509) *modssl_read_ocsp_certificates(const char *file)
+     while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) {
+         if (!other_certs) {
+                 other_certs = sk_X509_new_null();
+-                if (!other_certs)
+                if (!other_certs) {
+                        X509_free(x509);
+                        BIO_free(bio);
+                         return NULL;
+                }
+         }
+                 
+         if (!sk_X509_push(other_certs, x509)) {
+diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c
+index 5b3db6b..b508d7c 100644
+--- a/modules/ssl/ssl_util_stapling.c
+++ b/modules/ssl/ssl_util_stapling.c
+@@ -117,8 +117,10 @@ static X509 *stapling_get_issuer(modssl_ctx_t *mctx, X509 *x)
+     }
+ 
+     inctx = X509_STORE_CTX_new();
+-    if (!X509_STORE_CTX_init(inctx, st, NULL, NULL))
+    if (!X509_STORE_CTX_init(inctx, st, NULL, NULL)) {
+        X509_STORE_CTX_free(inctx);
+         return 0;
+    }
+     if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0)
+         issuer = NULL;
+     X509_STORE_CTX_cleanup(inctx);
+-- 
+2.33.0
+
--- a/httpd.spec
+++ b/httpd.spec
@ -8,7 +8,7 @@
 Name:             httpd
 Summary:          Apache HTTP Server
 Version:          2.4.43
-Release:          21
+Release:          26
 License:          ASL 2.0
 URL:              https://httpd.apache.org/
 Source0:          https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@ -105,6 +105,26 @@ Patch51:          backport-CVE-2022-36760.patch
 Patch52:          backport-CVE-2022-37436.patch
 Patch53:          backport-CVE-2023-27522.patch
 Patch54:          backport-CVE-2023-25690.patch
+Patch55:          backport-CVE-2019-17567.patch
+Patch56:          backport-Add-readbuffsize-api.patch
+Patch57:          backport-CVE-2023-31122-out-of-bound-Read.patch
+Patch58:          backport-CVE-2023-45802-improved-early-cleanup-of-stream.patch
+Patch59:          backport-release-memory-to-the-OS-when-needed.patch
+Patch60:          backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch
+Patch61:          backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch
+Patch62:          backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch
+Patch63:          backport-CVE-2023-38709-header-validation-after-content.patch
+Patch64:          backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch
+Patch65:          backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch
+Patch66:          backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch
+Patch67:          backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch
+Patch68:          backport-CVE-2024-38473-fix-comparsion-of-local-path.patch
+Patch69:          backport-CVE-2024-38473-fix-the-filename-redirected.patch
+Patch70:          backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch
+Patch71:          backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch
+Patch72:          backport-CVE-2024-38477-validate-hostsname.patch
+Patch73:          backport-CVE-2024-39884-maintain-trusted-flag.patch
+Patch74:          backport-CVE-2024-40725.patch

 BuildRequires:    gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
 BuildRequires:    zlib-devel libselinux-devel lua-devel brotli-devel
@ -541,6 +561,36 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd

 %changelog
+* Wed Aug 28 2024 Han Jinpeng <hanjinpeng@kylinos.cn> - 2.4.43-26
+- Type:CVE
+- ID:CVE-2024-40725
+- SUG:NA
+- DESC:fix CVE-2024-40725
+
+* Mon Jul 08 2024 chengyechun <chengyechun1@huawei.com> - 2.4.43-25
+- Type:CVE
+- ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
+- SUG:NA
+- DSEC:fix some CVEs
+
+* Tue May 07 2024 chengyechun <chengyechun1@huaiwe.com> - 2.4.43-24
+- Type:CVE
+- ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
+- SUG:NA
+- DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream
+
+* Fri Nov 03 2023 chengyechun <chengyechun1@huawei.com> - 2.4.43-23
+- Type:CVE
+- ID:CVE-2023-31122, CVE-2023-45802
+- SUG:restart
+- DESC:fix CVE-2023-31122 and CVE-2023-45802
+
+* Thu Apr 6 2023 chengyechun <chengyechun1@huawei.com> - 2.4.43-22
+- Type:CVE
+- ID:CVE-2019-17567
+- SUG:restart
+- DESC:fix CVE-2019-17567
+
 * Thu Mar 9 2023 chengyechun <chengyechun1@huawei.com> - 2.4.43-21
 - Type:CVE
 - ID:CVE-2023-27522, CVE-2023-25690
Author	SHA1	Message	Date
openeuler-ci-bot	fea4b141df	!221 fix CVE-2024-40725 From: @protkhn Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12	2024-10-16 06:57:56 +00:00
hanjinpeng	62c217361b	fix CVE-2024-40725	2024-10-15 09:27:40 +08:00
openeuler-ci-bot	657cef32f6	!204 fix some CVEs From: @chengyechun Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12	2024-07-09 07:04:32 +00:00
chengyechun	79f40ecd97	fix some CVEs	2024-07-09 09:55:24 +08:00
openeuler-ci-bot	c9dc7f7a8b	!189 fix CVE and sync some patches from upstream From: @chengyechun Reviewed-by: @sunsuwan Signed-off-by: @sunsuwan	2024-05-07 03:30:30 +00:00
chengyechun	5de95d7fa2	fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream	2024-05-07 11:03:25 +08:00
openeuler-ci-bot	3d4a4e3bf3	!172 [sync] PR-169: fix CVE-2023-31122 and CVE-2023-45802 From: @openeuler-sync-bot Reviewed-by: @robertxw Signed-off-by: @robertxw	2023-11-03 07:04:57 +00:00
chengyechun	b49ad22e49	fix CVE-2023-31122 and CVE-2023-45802 (cherry picked from commit 7b84c96fbdef9cb632d9ff83f601c746d9665fe0)	2023-11-03 14:33:37 +08:00
openeuler-ci-bot	c34f827044	!150 fix CVE-2019-17567 From: @chengyechun Reviewed-by: @seuzw Signed-off-by: @seuzw	2023-04-06 11:25:51 +00:00
chengyechun	c7ca485e13	fix CVE 2019 17567	2023-04-06 15:58:14 +08:00
openeuler-ci-bot	82af9a8584	!147 fix CVE-2023-27522, CVE-2023-25690 From: @chengyechun Reviewed-by: @seuzw Signed-off-by: @seuzw	2023-03-10 01:21:58 +00:00