SOURCES/httpd-2.4.37-CVE-2006-20001.patch

@@ -0,0 +1,20 @@
+diff --git a/modules/dav/main/util.c b/modules/dav/main/util.c
+index 1ae5914027c..3f7822fc931 100644
+--- a/modules/dav/main/util.c
++++ b/modules/dav/main/util.c
+@@ -801,8 +801,14 @@ static dav_error * dav_process_if_header(request_rec *r, dav_if_header **p_ih)
+                                                  "for the same state.");
+                         }
+                         condition = DAV_IF_COND_NOT;
++                        list += 2;
++                    }
++                    else {
++                        return dav_new_error(r->pool, HTTP_BAD_REQUEST,
++                                             DAV_ERR_IF_UNK_CHAR, 0,
++                                             "Invalid \"If:\" header: "
++                                             "Unexpected character in List");
+                     }
+-                    list += 2;
+                     break;
+ 
+                 case ' ':

SOURCES/httpd-2.4.37-CVE-2022-29404.patch

@@ -75,44 +75,8 @@ index 6bedcac..393343a 100644
  #ifdef AP_DEBUG
      {
          /* Make sure ap_getline() didn't leave any droppings. */
-diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
-index 7da9bde..1b7bb81 100644
---- a/modules/proxy/mod_proxy_http.c
-+++ b/modules/proxy/mod_proxy_http.c
-@@ -439,13 +439,10 @@ static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
-     apr_bucket *e;
-     apr_off_t bytes, fsize = 0;
-     apr_file_t *tmpfile = NULL;
--    apr_off_t limit;
- 
-     body_brigade = apr_brigade_create(p, bucket_alloc);
-     *bytes_spooled = 0;
- 
--    limit = ap_get_limit_req_body(r);
--
-     do {
-         if (APR_BRIGADE_EMPTY(input_brigade)) {
-             rv = stream_reqbody_read(req, input_brigade, 0);
-@@ -462,17 +459,6 @@ static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
-         apr_brigade_length(input_brigade, 1, &bytes);
- 
-         if (*bytes_spooled + bytes > MAX_MEM_SPOOL) {
--            /*
--             * LimitRequestBody does not affect Proxy requests (Should it?).
--             * Let it take effect if we decide to store the body in a
--             * temporary file on disk.
--             */
--            if (limit && (*bytes_spooled + bytes > limit)) {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088)
--                              "Request body is larger than the configured "
--                              "limit of %" APR_OFF_T_FMT, limit);
--                return HTTP_REQUEST_ENTITY_TOO_LARGE;
--            }
-             /* can't spool any more in memory; write latest brigade to disk */
-             if (tmpfile == NULL) {
-                 const char *temp_dir;
 diff --git a/server/core.c b/server/core.c
-index 09664fc..084e243 100644
+index a0bfaad..6556f20 100644
 --- a/server/core.c
 +++ b/server/core.c
 @@ -65,7 +65,7 @@

SOURCES/httpd-2.4.37-CVE-2022-31813.patch

@@ -1,8 +1,8 @@
 diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
-index 3d5b220..ec9a414 100644
+index efcc6ca..6626ea0 100644
 --- a/modules/proxy/proxy_util.c
 +++ b/modules/proxy/proxy_util.c
-@@ -3621,12 +3621,14 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3631,12 +3631,14 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
                                              char **old_cl_val,
                                              char **old_te_val)
  {
@@ -18,7 +18,7 @@ index 3d5b220..ec9a414 100644
      apr_bucket *e;
      int do_100_continue;
      conn_rec *origin = p_conn->connection;
-@@ -3662,6 +3664,52 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3672,6 +3674,52 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
      ap_xlate_proto_to_ascii(buf, strlen(buf));
      e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
      APR_BRIGADE_INSERT_TAIL(header_brigade, e);
@@ -71,7 +71,7 @@ index 3d5b220..ec9a414 100644
      if (dconf->preserve_host == 0) {
          if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
              if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
-@@ -3683,7 +3731,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3693,7 +3741,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
          /* don't want to use r->hostname, as the incoming header might have a
           * port attached
           */
@@ -80,7 +80,7 @@ index 3d5b220..ec9a414 100644
          if (!hostname) {
              hostname =  r->server->server_hostname;
              ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01092)
-@@ -3697,21 +3745,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3707,21 +3755,7 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
      ap_xlate_proto_to_ascii(buf, strlen(buf));
      e = apr_bucket_pool_create(buf, strlen(buf), p, c->bucket_alloc);
      APR_BRIGADE_INSERT_TAIL(header_brigade, e);
@@ -103,7 +103,7 @@ index 3d5b220..ec9a414 100644
  
      /* handle Via */
      if (conf->viaopt == via_block) {
-@@ -3778,8 +3812,6 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3788,8 +3822,6 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
       */
      if (dconf->add_forwarded_headers) {
          if (PROXYREQ_REVERSE == r->proxyreq) {
@@ -112,7 +112,7 @@ index 3d5b220..ec9a414 100644
              /* Add X-Forwarded-For: so that the upstream has a chance to
               * determine, where the original request came from.
               */
-@@ -3789,8 +3821,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3799,8 +3831,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
              /* Add X-Forwarded-Host: so that upstream knows what the
               * original request hostname was.
               */
@@ -124,7 +124,7 @@ index 3d5b220..ec9a414 100644
              }
  
              /* Add X-Forwarded-Server: so that upstream knows what the
-@@ -3802,10 +3835,27 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3812,10 +3845,27 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
          }
      }
  
@@ -155,7 +155,7 @@ index 3d5b220..ec9a414 100644
  
      creds = apr_table_get(r->notes, "proxy-basic-creds");
      if (creds) {
-@@ -3817,55 +3867,8 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3827,55 +3877,8 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
      headers_in = (const apr_table_entry_t *) headers_in_array->elts;
      for (counter = 0; counter < headers_in_array->nelts; counter++) {
          if (headers_in[counter].key == NULL
@@ -213,7 +213,7 @@ index 3d5b220..ec9a414 100644
          }
  
          buf = apr_pstrcat(p, headers_in[counter].key, ": ",
-@@ -3876,11 +3879,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+@@ -3886,11 +3889,9 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
          APR_BRIGADE_INSERT_TAIL(header_brigade, e);
      }
  
@@ -226,4 +226,4 @@ index 3d5b220..ec9a414 100644
 +    return rc;
  }
  
- PROXY_DECLARE(int) ap_proxy_pass_brigade(apr_bucket_alloc_t *bucket_alloc,
+ PROXY_DECLARE(int) ap_proxy_prefetch_input(request_rec *r,

SOURCES/httpd-2.4.37-CVE-2022-36760.patch

@@ -0,0 +1,23 @@
+From 5efc9507c487c37dfe2a279a4a0335cad701cd5f Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 10 Jan 2023 13:19:07 +0000
+Subject: [PATCH] cleanup on error
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1906540 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/proxy/mod_proxy_ajp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
+index 9cd7adbcbbf..07f37392d88 100644
+--- a/modules/proxy/mod_proxy_ajp.c
++++ b/modules/proxy/mod_proxy_ajp.c
+@@ -255,6 +255,8 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10396)
+                           "%s Transfer-Encoding is not supported",
+                           tenc);
++            /* We had a failure: Close connection to backend */
++            conn->close = 1;
+             return HTTP_INTERNAL_SERVER_ERROR;
+         }
+     } else {

SOURCES/httpd-2.4.37-CVE-2022-37436.patch

@@ -0,0 +1,129 @@
+From 8b6d55f6a047acf62675e32606b037f5eea8ccc7 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 10 Jan 2023 13:20:09 +0000
+Subject: [PATCH] Merge r1906539 from trunk:
+
+fail on bad header
+
+Submitted By: covener
+Reviewed By: covener, rpluem, gbechis
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906541 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/proxy/mod_proxy_http.c | 46 ++++++++++++++++++++--------------
+ server/protocol.c              |  2 ++
+ 2 files changed, 29 insertions(+), 19 deletions(-)
+
+diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
+index d74ae054ac9..ec4e7fb06b5 100644
+--- a/modules/proxy/mod_proxy_http.c
++++ b/modules/proxy/mod_proxy_http.c
+@@ -788,7 +788,7 @@ static void process_proxy_header(request_rec *r, proxy_dir_conf *c,
+  * any sense at all, since we depend on buffer still containing
+  * what was read by ap_getline() upon return.
+  */
+-static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
++static apr_status_t ap_proxy_read_headers(request_rec *r, request_rec *rr,
+                                   char *buffer, int size,
+                                   conn_rec *c, int *pread_len)
+ {
+@@ -820,19 +820,26 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+         rc = ap_proxygetline(tmp_bb, buffer, size, rr,
+                              AP_GETLINE_FOLD | AP_GETLINE_NOSPC_EOL, &len);
+ 
+-        if (len <= 0)
+-            break;
+ 
+-        if (APR_STATUS_IS_ENOSPC(rc)) {
+-            /* The header could not fit in the provided buffer, warn.
+-             * XXX: falls through with the truncated header, 5xx instead?
+-             */
+-            int trunc = (len > 128 ? 128 : len) / 2;
+-            ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124)
+-                    "header size is over the limit allowed by "
+-                    "ResponseFieldSize (%d bytes). "
+-                    "Bad response header: '%.*s[...]%s'",
+-                    size, trunc, buffer, buffer + len - trunc);
++        if (rc != APR_SUCCESS) {
++            if (APR_STATUS_IS_ENOSPC(rc)) {
++                int trunc = (len > 128 ? 128 : len) / 2;
++                ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124)
++                        "header size is over the limit allowed by "
++                        "ResponseFieldSize (%d bytes). "
++                        "Bad response header: '%.*s[...]%s'",
++                        size, trunc, buffer, buffer + len - trunc);
++            }
++            else {
++                ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10404) 
++                              "Error reading headers from backend");
++            }
++            r->headers_out = NULL;
++            return rc;
++        }
++
++        if (len <= 0) {
++            break;
+         }
+         else {
+             ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r, "%s", buffer);
+@@ -855,7 +862,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+                 if (psc->badopt == bad_error) {
+                     /* Nope, it wasn't even an extra HTTP header. Give up. */
+                     r->headers_out = NULL;
+-                    return;
++                    return APR_EINVAL;
+                 }
+                 else if (psc->badopt == bad_body) {
+                     /* if we've already started loading headers_out, then
+@@ -869,13 +876,13 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+                                       "in headers returned by %s (%s)",
+                                       r->uri, r->method);
+                         *pread_len = len;
+-                        return;
++                        return APR_SUCCESS;
+                     }
+                     else {
+                         ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01099)
+                                       "No HTTP headers returned by %s (%s)",
+                                       r->uri, r->method);
+-                        return;
++                        return APR_SUCCESS;
+                     }
+                 }
+             }
+@@ -905,6 +912,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+         process_proxy_header(r, dconf, buffer, value);
+         saw_headers = 1;
+     }
++    return APR_SUCCESS;
+ }
+ 
+ 
+@@ -1218,10 +1226,10 @@ int ap_proxy_http_process_response(proxy_http_req_t *req)
+                          "Set-Cookie", NULL);
+ 
+             /* shove the headers direct into r->headers_out */
+-            ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
+-                                  origin, &pread_len);
++            rc = ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
++                                       origin, &pread_len);
+ 
+-            if (r->headers_out == NULL) {
++            if (rc != APR_SUCCESS || r->headers_out == NULL) {
+                 ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106)
+                               "bad HTTP/%d.%d header returned by %s (%s)",
+                               major, minor, r->uri, r->method);
+diff --git a/server/protocol.c b/server/protocol.c
+index 7adc7f75c10..6f9540ad1de 100644
+--- a/server/protocol.c
++++ b/server/protocol.c
+@@ -508,6 +508,8 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
+         /* PR#43039: We shouldn't accept NULL bytes within the line */
+         bytes_handled = strlen(*s);
+         if (bytes_handled < *read) {
++            ap_log_data(APLOG_MARK, APLOG_DEBUG, ap_server_conf,
++                        "NULL bytes in header", *s, *read, 0);
+             *read = bytes_handled;
+             if (rv == APR_SUCCESS) {
+                 rv = APR_EINVAL;

SOURCES/httpd-2.4.37-CVE-2023-25690.patch

@@ -0,0 +1,586 @@
+diff --git a/docs/manual/mod/mod_rewrite.html.en b/docs/manual/mod/mod_rewrite.html.en
+index 815ec72..2b8ed35 100644
+--- a/docs/manual/mod/mod_rewrite.html.en
++++ b/docs/manual/mod/mod_rewrite.html.en
+@@ -1265,7 +1265,17 @@ cannot use <code>$N</code> in the substitution string!
+         <td>B</td>
+         <td>Escape non-alphanumeric characters in backreferences <em>before</em>
+         applying the transformation. <em><a href="../rewrite/flags.html#flag_b">details ...</a></em></td>
+-    </tr>
++     </tr>
++<tr class="odd">
++        <td>BCTLS</td>
++        <td>Like [B], but only escape control characters and spaces.
++        <em><a href="../rewrite/flags.html#flag_bctls">details ...</a></em></td>
++</tr>
++    <tr>
++        <td>BNE</td>
++        <td>Characters of [B] or [BCTLS] which should <strong>not</strong> be escaped.
++        <em><a href="../rewrite/flags.html#flag_bne">details ...</a></em></td>
++     </tr>
+ <tr class="odd">
+         <td>backrefnoplus|BNP</td>
+         <td>If backreferences are being escaped, spaces should be escaped to
+diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en
+index 80d0759..734809a 100644
+--- a/docs/manual/rewrite/flags.html.en
++++ b/docs/manual/rewrite/flags.html.en
+@@ -85,10 +85,6 @@ of how you might use them.</p>
+ <h2><a name="flag_b" id="flag_b">B (escape backreferences)</a></h2>
+ <p>The [B] flag instructs <code class="directive"><a href="../mod/mod_rewrite.html#rewriterule">RewriteRule</a></code> to escape non-alphanumeric
+ characters before applying the transformation.</p>
+-<p>In 2.4.26 and later, you can limit the escaping to specific characters
+-in backreferences by listing them: <code>[B=#?;]</code>. Note: The space
+-character can be used in the list of characters to escape, but it cannot be
+-the last character in the list.</p>
+ 
+ <p><code>mod_rewrite</code> has to unescape URLs before mapping them,
+ so backreferences are unescaped at the time they are applied.
+@@ -120,6 +116,20 @@ when the backend may break if presented with an unescaped URL.</p>
+ 
+ <p>An alternative to this flag is using a <code class="directive"><a href="../mod/mod_rewrite.html#rewritecond">RewriteCond</a></code> to capture against %{THE_REQUEST} which will capture
+ strings in the encoded form.</p>
++
++<p>In 2.4.26 and later, you can limit the escaping to specific characters
++in backreferences by listing them: <code>[B=#?;]</code>. Note: The space
++character can be used in the list of characters to escape, but you must quote
++the entire third argument of <code class="directive"><a href="../mod/mod_rewrite.html#rewriterule">RewriteRule</a></code>
++and the space must not be the last character in the list.</p>
++
++<pre class="prettyprint lang-config"># Escape spaces and question marks.  The quotes around the final argument
++# are required when a space is included.
++RewriteRule "^search/(.*)$" "/search.php?term=$1" "[B= ?]"</pre>
++
++<p>To limit the characters escaped this way, see <a href="#flag_bne">#flag_bne</a>
++and <a href="#flag_bctls">#flag_bctls</a></p>
++
+ </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
+ <div class="section">
+ <h2><a name="flag_bnp" id="flag_bnp">BNP|backrefnoplus (don't escape space to +)</a></h2>
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 38dbb24..b71c67c 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -101,6 +101,8 @@
+ #include "mod_rewrite.h"
+ #include "ap_expr.h"
+ 
++#include "test_char.h"
++
+ static ap_dbd_t *(*dbd_acquire)(request_rec*) = NULL;
+ static void (*dbd_prepare)(server_rec*, const char*, const char*) = NULL;
+ static const char* really_last_key = "rewrite_really_last";
+@@ -168,6 +170,8 @@ static const char* really_last_key = "rewrite_really_last";
+ #define RULEFLAG_END                (1<<17)
+ #define RULEFLAG_ESCAPENOPLUS       (1<<18)
+ #define RULEFLAG_QSLAST             (1<<19)
++#define RULEFLAG_QSNONE             (1<<20) /* programattic only */
++#define RULEFLAG_ESCAPECTLS         (1<<21)
+ 
+ /* return code of the rewrite rule
+  * the result may be escaped - or not
+@@ -321,7 +325,8 @@ typedef struct {
+     data_item *cookie;               /* added cookies                         */
+     int        skip;                 /* number of next rules to skip          */
+     int        maxrounds;            /* limit on number of loops with N flag  */
+-    char       *escapes;             /* specific backref escapes              */
++    const char *escapes;             /* specific backref escapes              */
++    const char *noescapes;           /* specific backref chars not to escape  */
+ } rewriterule_entry;
+ 
+ typedef struct {
+@@ -422,7 +427,9 @@ static const char *rewritemap_mutex_type = "rewrite-map";
+ /* Optional functions imported from mod_ssl when loaded: */
+ static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *rewrite_ssl_lookup = NULL;
+ static APR_OPTIONAL_FN_TYPE(ssl_is_https) *rewrite_is_https = NULL;
+-static char *escape_backref(apr_pool_t *p, const char *path, const char *escapeme, int noplus);
++static char *escape_backref(apr_pool_t *p, const char *path,
++                            const char *escapeme, const char *noescapeme,
++                            int flags);
+ 
+ /*
+  * +-------------------------------------------------------+
+@@ -645,18 +652,26 @@ static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix,
+     return where;
+ }
+ 
++
+ /*
+  * Escapes a backreference in a similar way as php's urlencode does.
+  * Based on ap_os_escape_path in server/util.c
+  */
+-static char *escape_backref(apr_pool_t *p, const char *path, const char *escapeme, int noplus) {
+-    char *copy = apr_palloc(p, 3 * strlen(path) + 3);
++static char *escape_backref(apr_pool_t *p, const char *path,
++                            const char *escapeme, const char *noescapeme,
++                            int flags)
++{
++    char *copy = apr_palloc(p, 3 * strlen(path) + 1);
+     const unsigned char *s = (const unsigned char *)path;
+     unsigned char *d = (unsigned char *)copy;
+-    unsigned c;
++    int noplus = (flags & RULEFLAG_ESCAPENOPLUS) != 0;
++    int ctls = (flags & RULEFLAG_ESCAPECTLS) != 0;
++    unsigned char c;
+ 
+     while ((c = *s)) {
+-        if (!escapeme) { 
++        if (((ctls ? !TEST_CHAR(c, T_VCHAR_OBSTEXT) : !escapeme)
++             || (escapeme && ap_strchr_c(escapeme, c)))
++            && (!noescapeme || !ap_strchr_c(noescapeme, c))) {
+             if (apr_isalnum(c) || c == '_') {
+                 *d++ = c;
+             }
+@@ -667,23 +682,8 @@ static char *escape_backref(apr_pool_t *p, const char *path, const char *escapem
+                 d = c2x(c, '%', d);
+             }
+         }
+-        else { 
+-            const char *esc = escapeme;
+-            while (*esc) { 
+-                if (c == *esc) { 
+-                    if (c == ' ' && !noplus) { 
+-                        *d++ = '+';
+-                    }
+-                    else { 
+-                        d = c2x(c, '%', d);
+-                    }
+-                    break;
+-                }
+-                ++esc;
+-            }
+-            if (!*esc) { 
+-                *d++ = c;
+-            }
++        else {
++            *d++ = c;
+         }
+         ++s;
+     }
+@@ -761,15 +761,24 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme)
+                        ap_escape_uri(p, cp), NULL);
+ }
+ 
++
+ /*
+  * split out a QUERY_STRING part from
+  * the current URI string
+  */
+-static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, 
+-                               int qslast)
++static void splitout_queryargs(request_rec *r, int flags)
+ {
+     char *q;
+     int split;
++    int qsappend = flags & RULEFLAG_QSAPPEND;
++    int qsdiscard = flags & RULEFLAG_QSDISCARD;
++    int qslast = flags & RULEFLAG_QSLAST;
++
++    if (flags & RULEFLAG_QSNONE) {
++        rewritelog((r, 2, NULL, "discarding query string, no parse from substitution"));
++        r->args = NULL;
++        return;
++    }
+ 
+     /* don't touch, unless it's a scheme for which a query string makes sense.
+      * See RFC 1738 and RFC 2368.
+@@ -794,7 +803,7 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
+         olduri = apr_pstrdup(r->pool, r->filename);
+         *q++ = '\0';
+         if (qsappend) {
+-            if (*q) { 
++            if (*q) {
+                 r->args = apr_pstrcat(r->pool, q, "&" , r->args, NULL);
+             }
+         }
+@@ -802,9 +811,9 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
+             r->args = apr_pstrdup(r->pool, q);
+         }
+ 
+-        if (r->args) { 
++        if (r->args) {
+            len = strlen(r->args);
+-      
++
+            if (!len) {
+                r->args = NULL;
+            }
+@@ -2436,7 +2445,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     /* escape the backreference */
+                     char *tmp2, *tmp;
+                     tmp = apr_pstrmemdup(pool, bri->source + bri->regmatch[n].rm_so, span);
+-                    tmp2 = escape_backref(pool, tmp, entry->escapes, entry->flags & RULEFLAG_ESCAPENOPLUS);
++                    tmp2 = escape_backref(pool, tmp, entry->escapes, entry->noescapes,
++                                          entry->flags);
+                     rewritelog((ctx->r, 5, ctx->perdir, "escaping backreference '%s' to '%s'",
+                             tmp, tmp2));
+ 
+@@ -2733,7 +2743,7 @@ static apr_status_t rewritelock_remove(void *data)
+  * XXX: what an inclined parser. Seems we have to leave it so
+  *      for backwards compat. *sigh*
+  */
+-static int parseargline(char *str, char **a1, char **a2, char **a3)
++static int parseargline(char *str, char **a1, char **a2, char **a2_end, char **a3)
+ {
+     char quote;
+ 
+@@ -2784,8 +2794,10 @@ static int parseargline(char *str, char **a1, char **a2, char **a3)
+ 
+     if (!*str) {
+         *a3 = NULL; /* 3rd argument is optional */
++        *a2_end = str;
+         return 0;
+     }
++    *a2_end = str;
+     *str++ = '\0';
+ 
+     while (apr_isspace(*str)) {
+@@ -3323,7 +3335,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
+     rewrite_server_conf *sconf;
+     rewritecond_entry *newcond;
+     ap_regex_t *regexp;
+-    char *a1 = NULL, *a2 = NULL, *a3 = NULL;
++    char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL;
+     const char *err;
+ 
+     sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module);
+@@ -3341,7 +3353,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
+      * of the argument line. So we can use a1 .. a3 without
+      * copying them again.
+      */
+-    if (parseargline(str, &a1, &a2, &a3)) {
++    if (parseargline(str, &a1, &a2, &a2_end, &a3)) {
+         return apr_pstrcat(cmd->pool, "RewriteCond: bad argument line '", str,
+                            "'", NULL);
+     }
+@@ -3500,13 +3512,24 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
+     case 'B':
+         if (!*key || !strcasecmp(key, "ackrefescaping")) {
+             cfg->flags |= RULEFLAG_ESCAPEBACKREF;
+-            if (val && *val) { 
++            if (val && *val) {
+                 cfg->escapes = val;
+             }
+         }
++        else if (!strcasecmp(key, "NE")) {
++            if (val && *val) {
++                cfg->noescapes = val;
++            }
++            else {
++                return "flag 'BNE' wants a list of characters (i.e. [BNE=...])";
++            }
++        }
+         else if (!strcasecmp(key, "NP") || !strcasecmp(key, "ackrefernoplus")) { 
+             cfg->flags |= RULEFLAG_ESCAPENOPLUS;
+         }
++        else if (!strcasecmp(key, "CTLS")) {
++            cfg->flags |= RULEFLAG_ESCAPECTLS|RULEFLAG_ESCAPEBACKREF;
++        }
+         else {
+             ++error;
+         }
+@@ -3749,7 +3772,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
+     rewrite_server_conf *sconf;
+     rewriterule_entry *newrule;
+     ap_regex_t *regexp;
+-    char *a1 = NULL, *a2 = NULL, *a3 = NULL;
++    char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL;
+     const char *err;
+ 
+     sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module);
+@@ -3763,12 +3786,11 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
+     }
+ 
+     /*  parse the argument line ourself */
+-    if (parseargline(str, &a1, &a2, &a3)) {
++    if (parseargline(str, &a1, &a2, &a2_end, &a3)) {
+         return apr_pstrcat(cmd->pool, "RewriteRule: bad argument line '", str,
+                            "'", NULL);
+     }
+ 
+-    /* arg3: optional flags field */
+     newrule->forced_mimetype     = NULL;
+     newrule->forced_handler      = NULL;
+     newrule->forced_responsecode = HTTP_MOVED_TEMPORARILY;
+@@ -3777,6 +3799,9 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
+     newrule->cookie = NULL;
+     newrule->skip   = 0;
+     newrule->maxrounds = REWRITE_MAX_ROUNDS;
++    newrule->escapes = newrule->noescapes = NULL;
++
++    /* arg3: optional flags field */
+     if (a3 != NULL) {
+         if ((err = cmd_parseflagfield(cmd->pool, newrule, a3,
+                                       cmd_rewriterule_setflag)) != NULL) {
+@@ -3810,6 +3835,17 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
+         newrule->flags |= RULEFLAG_NOSUB;
+     }
+ 
++    if (*(a2_end-1) == '?') {
++        /* a literal ? at the end of the unsubstituted rewrite rule */
++        newrule->flags |= RULEFLAG_QSNONE;
++        *(a2_end-1) = '\0'; /* trailing ? has done its job */
++    }
++    else if (newrule->flags & RULEFLAG_QSDISCARD) {
++        if (NULL == ap_strchr(newrule->output, '?')) {
++            newrule->flags |= RULEFLAG_QSNONE;
++        }
++    }
++
+     /* now, if the server or per-dir config holds an
+      * array of RewriteCond entries, we take it for us
+      * and clear the array
+@@ -4215,9 +4251,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+         r->path_info = NULL;
+     }
+ 
+-    splitout_queryargs(r, p->flags & RULEFLAG_QSAPPEND, 
+-                          p->flags & RULEFLAG_QSDISCARD, 
+-                          p->flags & RULEFLAG_QSLAST);
++    splitout_queryargs(r, p->flags);
+ 
+     /* Add the previously stripped per-directory location prefix, unless
+      * (1) it's an absolute URL path and
+@@ -4696,8 +4730,25 @@ static int hook_uri2file(request_rec *r)
+     }
+ 
+     if (rulestatus) {
+-        unsigned skip;
+-        apr_size_t flen;
++        unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
++        apr_size_t flen =  r->filename ? strlen(r->filename) : 0;
++        int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0);
++        int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);
++
++        if (r->args
++                && !will_escape
++                && *(ap_scan_vchar_obstext(r->args))) {
++            /*
++             * We have a raw control character or a ' ' in r->args.
++             * Correct encoding was missed.
++             * Correct encoding was missed and we're not going to escape
++             * it before returning.
++             */
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10410)
++                          "Rewritten query string contains control "
++                          "characters or spaces");
++            return HTTP_FORBIDDEN;
++        }
+ 
+         if (ACTION_STATUS == rulestatus) {
+             int n = r->status;
+@@ -4706,8 +4757,7 @@ static int hook_uri2file(request_rec *r)
+             return n;
+         }
+ 
+-        flen = r->filename ? strlen(r->filename) : 0;
+-        if (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0) {
++        if (to_proxyreq) {
+             /* it should be go on as an internal proxy request */
+ 
+             /* check if the proxy module is enabled, so
+@@ -4749,7 +4799,7 @@ static int hook_uri2file(request_rec *r)
+                         r->filename));
+             return OK;
+         }
+-        else if ((skip = is_absolute_uri(r->filename, NULL)) > 0) {
++        else if (skip_absolute > 0) {
+             int n;
+ 
+             /* it was finally rewritten to a remote URL */
+@@ -4757,7 +4807,7 @@ static int hook_uri2file(request_rec *r)
+             if (rulestatus != ACTION_NOESCAPE) {
+                 rewritelog((r, 1, NULL, "escaping %s for redirect",
+                             r->filename));
+-                r->filename = escape_absolute_uri(r->pool, r->filename, skip);
++                r->filename = escape_absolute_uri(r->pool, r->filename, skip_absolute);
+             }
+ 
+             /* append the QUERY_STRING part */
+@@ -4981,7 +5031,26 @@ static int hook_fixup(request_rec *r)
+      */
+     rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
+     if (rulestatus) {
+-        unsigned skip;
++        unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
++        int to_proxyreq = 0;
++        int will_escape = 0;
++
++        l = strlen(r->filename);
++        to_proxyreq = l > 6 && strncmp(r->filename, "proxy:", 6) == 0;
++        will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);
++
++        if (r->args
++               && !will_escape
++               &&  *(ap_scan_vchar_obstext(r->args))) {
++            /*
++             * We have a raw control character or a ' ' in r->args.
++             * Correct encoding was missed.
++             */
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10411)
++                          "Rewritten query string contains control "
++                          "characters or spaces");
++            return HTTP_FORBIDDEN;
++        }
+ 
+         if (ACTION_STATUS == rulestatus) {
+             int n = r->status;
+@@ -4990,8 +5059,7 @@ static int hook_fixup(request_rec *r)
+             return n;
+         }
+ 
+-        l = strlen(r->filename);
+-        if (l > 6 && strncmp(r->filename, "proxy:", 6) == 0) {
++        if (to_proxyreq) {
+             /* it should go on as an internal proxy request */
+ 
+             /* make sure the QUERY_STRING and
+@@ -5015,7 +5083,7 @@ static int hook_fixup(request_rec *r)
+                         "%s [OK]", r->filename));
+             return OK;
+         }
+-        else if ((skip = is_absolute_uri(r->filename, NULL)) > 0) {
++        else if (skip_absolute > 0) {
+             /* it was finally rewritten to a remote URL */
+ 
+             /* because we are in a per-dir context
+@@ -5024,7 +5092,7 @@ static int hook_fixup(request_rec *r)
+              */
+             if (dconf->baseurl != NULL) {
+                 /* skip 'scheme://' */
+-                cp = r->filename + skip;
++                cp = r->filename + skip_absolute;
+ 
+                 if ((cp = ap_strchr(cp, '/')) != NULL && *(++cp)) {
+                     rewritelog((r, 2, dconf->directory,
+@@ -5069,7 +5137,7 @@ static int hook_fixup(request_rec *r)
+             if (rulestatus != ACTION_NOESCAPE) {
+                 rewritelog((r, 1, dconf->directory, "escaping %s for redirect",
+                             r->filename));
+-                r->filename = escape_absolute_uri(r->pool, r->filename, skip);
++                r->filename = escape_absolute_uri(r->pool, r->filename, skip_absolute);
+             }
+ 
+             /* append the QUERY_STRING part */
+diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
+index cbb0872..873ccf1 100644
+--- a/modules/proxy/mod_proxy_ajp.c
++++ b/modules/proxy/mod_proxy_ajp.c
+@@ -69,6 +69,16 @@ static int proxy_ajp_canon(request_rec *r, char *url)
+         path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
+                                  r->proxyreq);
+         search = r->args;
++        if (search && *(ap_scan_vchar_obstext(search))) {
++            /*
++             * We have a raw control character or a ' ' in r->args.
++             * Correct encoding was missed.
++             */
++             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406)
++                           "To be forwarded query string contains control "
++                           "characters or spaces");
++             return HTTP_FORBIDDEN;
++        }
+     }
+     if (path == NULL)
+         return HTTP_BAD_REQUEST;
+diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
+index 3a28038..c599e1a 100644
+--- a/modules/proxy/mod_proxy_balancer.c
++++ b/modules/proxy/mod_proxy_balancer.c
+@@ -106,6 +106,16 @@ static int proxy_balancer_canon(request_rec *r, char *url)
+         path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
+                                  r->proxyreq);
+         search = r->args;
++        if (search && *(ap_scan_vchar_obstext(search))) {
++            /*
++             * We have a raw control character or a ' ' in r->args.
++             * Correct encoding was missed.
++             */
++             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407)
++                           "To be forwarded query string contains control "
++                           "characters or spaces");
++             return HTTP_FORBIDDEN;
++        }
+     }
+     if (path == NULL)
+         return HTTP_BAD_REQUEST;
+diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
+index 7573638..fe7b322 100644
+--- a/modules/proxy/mod_proxy_http.c
++++ b/modules/proxy/mod_proxy_http.c
+@@ -90,6 +90,16 @@ static int proxy_http_canon(request_rec *r, char *url)
+             path = ap_proxy_canonenc(r->pool, url, strlen(url),
+                                      enc_path, 0, r->proxyreq);
+             search = r->args;
++            if (search && *(ap_scan_vchar_obstext(search))) {
++                /*
++                 * We have a raw control character or a ' ' in r->args.
++                 * Correct encoding was missed.
++                 */
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408)
++                              "To be forwarded query string contains control "
++                              "characters or spaces");
++                return HTTP_FORBIDDEN;
++            }
+         }
+         break;
+     case PROXYREQ_PROXY:
+diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c
+index e005a94..f5e27d9 100644
+--- a/modules/proxy/mod_proxy_wstunnel.c
++++ b/modules/proxy/mod_proxy_wstunnel.c
+@@ -77,6 +77,16 @@ static int proxy_wstunnel_canon(request_rec *r, char *url)
+         path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
+                                  r->proxyreq);
+         search = r->args;
++        if (search && *(ap_scan_vchar_obstext(search))) {
++            /*
++             * We have a raw control character or a ' ' in r->args.
++             * Correct encoding was missed.
++             */
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409)
++                          "To be forwarded query string contains control "
++                          "characters or spaces");
++            return HTTP_FORBIDDEN;
++        }
+     }
+     if (path == NULL)
+         return HTTP_BAD_REQUEST;
+diff --git a/server/gen_test_char.c b/server/gen_test_char.c
+index 48ae6f4..6a153a3 100644
+--- a/server/gen_test_char.c
++++ b/server/gen_test_char.c
+@@ -169,5 +169,15 @@ int main(int argc, char *argv[])
+ 
+     printf("\n};\n");
+ 
++
++    printf(
++      "/* we assume the folks using this ensure 0 <= c < 256... which means\n"
++      " * you need a cast to (unsigned char) first, you can't just plug a\n"
++      " * char in here and get it to work, because if char is signed then it\n"
++      " * will first be sign extended.\n"
++      " */\n"
++      "#define TEST_CHAR(c, f) (test_char_table[(unsigned char)(c)] & (f))\n"
++    );
++
+     return 0;
+ }
+diff --git a/server/util.c b/server/util.c
+index 45051b7..9d897d4 100644
+--- a/server/util.c
++++ b/server/util.c
+@@ -74,13 +74,6 @@
+  */
+ #include "test_char.h"
+ 
+-/* we assume the folks using this ensure 0 <= c < 256... which means
+- * you need a cast to (unsigned char) first, you can't just plug a
+- * char in here and get it to work, because if char is signed then it
+- * will first be sign extended.
+- */
+-#define TEST_CHAR(c, f)        (test_char_table[(unsigned char)(c)] & (f))
+-
+ /* Win32/NetWare/OS2 need to check for both forward and back slashes
+  * in ap_getparents() and ap_escape_url.
+  */

SOURCES/httpd-2.4.37-CVE-2023-27522.patch

@@ -0,0 +1,89 @@
+diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
+index 9dcbed1..a1b564d 100644
+--- a/modules/proxy/mod_proxy_uwsgi.c
++++ b/modules/proxy/mod_proxy_uwsgi.c
+@@ -304,18 +304,16 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend,
+     pass_bb = apr_brigade_create(r->pool, c->bucket_alloc);
+ 
+     len = ap_getline(buffer, sizeof(buffer), rp, 1);
+-
+     if (len <= 0) {
+-        /* oops */
++        /* invalid or empty */
+         return HTTP_INTERNAL_SERVER_ERROR;
+     }
+-
+     backend->worker->s->read += len;
+-
+-    if (len >= sizeof(buffer) - 1) {
+-        /* oops */
++    if ((apr_size_t)len >= sizeof(buffer)) {
++        /* too long */
+         return HTTP_INTERNAL_SERVER_ERROR;
+     }
++
+     /* Position of http status code */
+     if (apr_date_checkmask(buffer, "HTTP/#.# ###*")) {
+         status_start = 9;
+@@ -324,8 +322,8 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend,
+         status_start = 7;
+     }
+     else {
+-        /* oops */
+-        return HTTP_INTERNAL_SERVER_ERROR;
++        /* not HTTP */
++        return HTTP_BAD_GATEWAY;
+     }
+     status_end = status_start + 3;
+ 
+@@ -345,21 +343,44 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend,
+     }
+     r->status_line = apr_pstrdup(r->pool, &buffer[status_start]);
+ 
+-    /* start parsing headers */
++    /* parse headers */
+     while ((len = ap_getline(buffer, sizeof(buffer), rp, 1)) > 0) {
++        if ((apr_size_t)len >= sizeof(buffer)) {
++            /* too long */
++            len = -1;
++            break;
++        }
+         value = strchr(buffer, ':');
+-        /* invalid header skip */
+-        if (!value)
+-            continue;
+-        *value = '\0';
+-        ++value;
++        if (!value) {
++            /* invalid header */
++            len = -1;
++            break;
++        }
++        *value++ = '\0';
++        if (*ap_scan_http_token(buffer)) {
++            /* invalid name */
++            len = -1;
++            break;
++        }
+         while (apr_isspace(*value))
+             ++value;
+         for (end = &value[strlen(value) - 1];
+              end > value && apr_isspace(*end); --end)
+             *end = '\0';
++        if (*ap_scan_http_field_content(value)) {
++            /* invalid value */
++            len = -1;
++            break;
++        }
+         apr_table_add(r->headers_out, buffer, value);
+     }
++    if (len < 0) {
++        /* Reset headers, but not to NULL because things below the chain expect
++         * this to be non NULL e.g. the ap_content_length_filter.
++         */
++        r->headers_out = apr_table_make(r->pool, 1);
++        return HTTP_BAD_GATEWAY;
++    }
+ 
+     if ((buf = apr_table_get(r->headers_out, "Content-Type"))) {
+         ap_set_content_type(r, apr_pstrdup(r->pool, buf));

SOURCES/httpd-2.4.37-CVE-2023-31122.patch

@@ -0,0 +1,11 @@
+--- a/modules/core/mod_macro.c	2023/10/16 06:19:16	1912992
++++ b/modules/core/mod_macro.c	2023/10/16 06:38:32	1912993
+@@ -483,7 +483,7 @@
+     for (i = 0; i < contents->nelts; i++) {
+         const char *errmsg;
+         /* copy the line and substitute macro parameters */
+-        strncpy(line, ((char **) contents->elts)[i], MAX_STRING_LEN - 1);
++        apr_cpystrn(line, ((char **) contents->elts)[i], MAX_STRING_LEN);
+         errmsg = substitute_macro_args(line, MAX_STRING_LEN,
+                                        macro, replacements, used);
+         if (errmsg) {

SOURCES/httpd-2.4.37-CVE-2023-38709.patch

@@ -0,0 +1,74 @@
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index 393343a..16cb23c 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -1348,6 +1348,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+          */
+         apr_table_clear(r->headers_out);
+         apr_table_clear(r->err_headers_out);
++        r->content_type = r->content_encoding = NULL;
++        r->content_languages = NULL;
++        r->clength = r->chunked = 0;
+         apr_brigade_cleanup(b);
+ 
+         /* Don't recall ap_die() if we come back here (from its own internal
+@@ -1364,8 +1367,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         APR_BRIGADE_INSERT_TAIL(b, e);
+         e = apr_bucket_eos_create(c->bucket_alloc);
+         APR_BRIGADE_INSERT_TAIL(b, e);
+-        r->content_type = r->content_encoding = NULL;
+-        r->content_languages = NULL;
+         ap_set_content_length(r, 0);
+         recursive_error = 1;
+     }
+@@ -1392,6 +1393,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     if (!apr_is_empty_table(r->err_headers_out)) {
+         r->headers_out = apr_table_overlay(r->pool, r->err_headers_out,
+                                            r->headers_out);
++        apr_table_clear(r->err_headers_out);
+     }
+ 
+     /*
+@@ -1411,6 +1413,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         fixup_vary(r);
+     }
+ 
++
++    /*
++     * Control cachability for non-cacheable responses if not already set by
++     * some other part of the server configuration.
++     */
++    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
++        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
++        ap_recent_rfc822_date(date, r->request_time);
++        apr_table_addn(r->headers_out, "Expires", date);
++    }
++
+     /*
+      * Now remove any ETag response header field if earlier processing
+      * says so (such as a 'FileETag None' directive).
+@@ -1423,6 +1436,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     basic_http_header_check(r, &protocol);
+     ap_set_keepalive(r);
+ 
++    /* 204/304 responses don't have content related headers */
+     if (AP_STATUS_IS_HEADER_ONLY(r->status)) {
+         apr_table_unset(r->headers_out, "Transfer-Encoding");
+         apr_table_unset(r->headers_out, "Content-Length");
+@@ -1465,16 +1479,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         apr_table_setn(r->headers_out, "Content-Language", field);
+     }
+ 
+-    /*
+-     * Control cachability for non-cacheable responses if not already set by
+-     * some other part of the server configuration.
+-     */
+-    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
+-        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
+-        ap_recent_rfc822_date(date, r->request_time);
+-        apr_table_addn(r->headers_out, "Expires", date);
+-    }
+-
+     /* This is a hack, but I can't find anyway around it.  The idea is that
+      * we don't want to send out 0 Content-Lengths if it is a head request.
+      * This happens when modules try to outsmart the server, and return

SOURCES/httpd-2.4.37-CVE-2024-38473.patch

@@ -0,0 +1,172 @@
+diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
+index a6df1b8..94ec87e 100644
+--- a/modules/proxy/mod_proxy.c
++++ b/modules/proxy/mod_proxy.c
+@@ -968,6 +968,7 @@ static int proxy_fixup(request_rec *r)
+ 
+     return OK;      /* otherwise; we've done the best we can */
+ }
++
+ /* Send a redirection if the request contains a hostname which is not */
+ /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */
+ /* servers like Netscape's allow this and access hosts from the local */
+@@ -1021,7 +1022,7 @@ static int proxy_handler(request_rec *r)
+         ap_get_module_config(sconf, &proxy_module);
+     apr_array_header_t *proxies = conf->proxies;
+     struct proxy_remote *ents = (struct proxy_remote *) proxies->elts;
+-    int i, rc, access_status;
++    int rc = DECLINED, access_status, i;
+     int direct_connect = 0;
+     const char *str;
+     apr_int64_t maxfwd;
+@@ -1036,19 +1037,28 @@ static int proxy_handler(request_rec *r)
+         return DECLINED;
+     }
+ 
+-    if (!r->proxyreq) {
+-        /* We may have forced the proxy handler via config or .htaccess */
+-        if (r->handler &&
+-            strncmp(r->handler, "proxy:", 6) == 0 &&
+-            strncmp(r->filename, "proxy:", 6) != 0) {
+-            r->proxyreq = PROXYREQ_REVERSE;
+-            r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
++    /* We may have forced the proxy handler via config or .htaccess */
++    if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) {
++        char *old_filename = r->filename;
++
++        r->proxyreq = PROXYREQ_REVERSE;
++        r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
++
++        /* Still need to fixup/canonicalize r->filename */
++        rc = ap_proxy_fixup_uds_filename(r);
++        if (rc <= OK) {
++            rc = proxy_fixup(r);
+         }
+-        else {
+-            return DECLINED;
++        if (rc != OK) {
++            r->filename = old_filename;
++            r->proxyreq = 0;
+         }
+-    } else if (strncmp(r->filename, "proxy:", 6) != 0) {
+-        return DECLINED;
++    }
++    else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) {
++        rc = OK;
++    }
++    if (rc != OK) {
++        return rc;
+     }
+ 
+     /* handle max-forwards / OPTIONS / TRACE */
+diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
+index e5c0a26..354f395 100644
+--- a/modules/proxy/mod_proxy.h
++++ b/modules/proxy/mod_proxy.h
+@@ -921,6 +921,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov
+                                                                  proxy_balancer *balancer,
+                                                                  unsigned int *index);
+ 
++/*
++ * Strip the UDS part of r->filename if any, and put the UDS path in
++ * r->notes ("uds_path")
++ * @param r        current request
++ * @return         OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error
++ */
++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r);
++
+ /**
+  * Get the most suitable worker and/or balancer for the request
+  * @param worker   worker used for processing request
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 6626ea0..6244e74 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -2098,7 +2098,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke
+  * were passed a UDS url (eg: from mod_proxy) and adjust uds_path
+  * as required.  
+  */
+-static int fix_uds_filename(request_rec *r, char **url) 
++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) 
+ {
+     char *uds_url = r->filename + 6, *origin_url;
+ 
+@@ -2106,7 +2106,6 @@ static int fix_uds_filename(request_rec *r, char **url)
+             !ap_cstr_casecmpn(uds_url, "unix:", 5) &&
+             (origin_url = ap_strchr(uds_url + 5, '|'))) {
+         char *uds_path = NULL;
+-        apr_size_t url_len;
+         apr_uri_t urisock;
+         apr_status_t rv;
+ 
+@@ -2122,21 +2121,20 @@ static int fix_uds_filename(request_rec *r, char **url)
+         if (!uds_path) {
+              ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292)
+                      "Invalid proxy UDS filename (%s)", r->filename);
+-             return 0;
++             return HTTP_BAD_REQUEST;
+         }
+         apr_table_setn(r->notes, "uds_path", uds_path);
+ 
+-        /* Remove the UDS path from *url and r->filename */
+-        url_len = strlen(origin_url);
+-        *url = apr_pstrmemdup(r->pool, origin_url, url_len);
+-        memcpy(uds_url, *url, url_len + 1);
+-
+         ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
+-                 "*: rewrite of url due to UDS(%s): %s (%s)",
+-                 uds_path, *url, r->filename);
++                "*: fixup UDS from %s: %s (%s)",
++                r->filename, origin_url, uds_path);
++
++        /* Overwrite the UDS part in place */
++        memmove(uds_url, origin_url, strlen(origin_url) + 1);
++        return OK;
+      }
+ 
+-     return 1;
++     return DECLINED;
+ }
+ 
+ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+@@ -2155,9 +2153,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
+                           "%s: found worker %s for %s",
+                           (*worker)->s->scheme, (*worker)->s->name, *url);
+-            if (!forward && !fix_uds_filename(r, url)) {
+-                     return HTTP_INTERNAL_SERVER_ERROR;
+-            }
+             access_status = OK;
+         }
+         else if (forward) {
+@@ -2187,9 +2182,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+                  * regarding the Connection header in the request.
+                  */
+                 apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1");
+-                if (!fix_uds_filename(r, url)) {
+-                     return HTTP_INTERNAL_SERVER_ERROR;
+-                }
+             }
+         }
+     }
+@@ -2199,6 +2191,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
+                       "all workers are busy.  Unable to serve %s", *url);
+         access_status = HTTP_SERVICE_UNAVAILABLE;
+     }
++
++    if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) {
++        int rc = ap_proxy_fixup_uds_filename(r);
++        if (ap_is_HTTP_ERROR(rc)) {
++            return rc;
++        }
++        /* If the URL has changed in r->filename, take everything after
++         * the "proxy:" prefix.
++         */
++        if (rc == OK) {
++            *url = apr_pstrdup(r->pool, r->filename + 6);
++        }
++    }
++
+     return access_status;
+ }
+ 

SOURCES/httpd-2.4.37-CVE-2024-38474+.patch

@@ -0,0 +1,439 @@
+diff --git a/docs/manual/mod/mod_rewrite.html.en b/docs/manual/mod/mod_rewrite.html.en
+index 2b8ed35..b7f1c31 100644
+--- a/docs/manual/mod/mod_rewrite.html.en
++++ b/docs/manual/mod/mod_rewrite.html.en
+@@ -1403,6 +1403,16 @@ cannot use <code>$N</code> in the substitution string!
+         <td>Force the <a class="glossarylink" href="../glossary.html#mime-type" title="see glossary">MIME-type</a> of the target file
+         to be the specified type. <em><a href="../rewrite/flags.html#flag_t">details ...</a></em></td>
+     </tr>
++<tr>
++        <td>UnsafeAllow3F</td>
++        <td>Allows substitutions from URL's that may be unsafe.
++        <em><a href="../rewrite/flags.html#flag_unsafe_allow_3f">details ...</a></em></td>
++    </tr>
++<tr>
++        <td>UnsafePrefixStat</td>
++        <td>Allows potentially unsafe substitutions from a leading variable or backreference to a filesystem path.
++        <em><a href="../rewrite/flags.html#flag_unsafe_prefix_stat">details ...</a></em></td>
++    </tr>
+ </table>
+ 
+ <div class="note"><h3>Home directory expansion</h3>
+diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en
+index 734809a..30d549d 100644
+--- a/docs/manual/rewrite/flags.html.en
++++ b/docs/manual/rewrite/flags.html.en
+@@ -768,6 +768,30 @@ re-processing (including subsequent rounds of mod_rewrite processing).
+ The <code>L</code> flag can be useful in this context to end the
+ <em>current</em> round of mod_rewrite processing.</p>
+ 
++</div>
++
++<div class="section">
++<h2><a name="flag_unsafe_allow_3f" id="flag_unsafe_allow_3f">UnsafeAllow3F</a></h2>
++
++<p>
++Setting this flag is required to allow a rewrite to continue If the
++HTTP request being written has an encoded question mark, '%3f', and the
++rewritten result has a '?' in the substiution.  This protects from a malicious
++URL taking advantage of a capture and re-substitution of the encoded
++question mark.</p>
++
++</div>
++<div class="section">
++<h2><a name="flag_unsafe_prefix_status" id="flag_unsafe_prefix_status">UnsafePrefixStat</a></h2>
++
++<p>
++Setting this flag is required in server-scoped substitutions
++start with a variable or backreference and resolve to a filesystem path.
++These substitutions are not prefixed with the document root.
++This protects from a malicious URL causing the expanded substitution to
++map to an unexpected filesystem location.
++</p>
++
+ </div></div>
+ <div class="bottomlang">
+ <p><span>Available Languages: </span><a href="../en/rewrite/flags.html" title="English">&nbsp;en&nbsp;</a> |
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index b71c67c..797f093 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -172,6 +172,8 @@ static const char* really_last_key = "rewrite_really_last";
+ #define RULEFLAG_QSLAST             (1<<19)
+ #define RULEFLAG_QSNONE             (1<<20) /* programattic only */
+ #define RULEFLAG_ESCAPECTLS         (1<<21)
++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22)
++#define RULEFLAG_UNSAFE_ALLOW3F     (1<<23)
+ 
+ /* return code of the rewrite rule
+  * the result may be escaped - or not
+@@ -179,7 +181,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define ACTION_NORMAL               (1<<0)
+ #define ACTION_NOESCAPE             (1<<1)
+ #define ACTION_STATUS               (1<<2)
+-
++#define ACTION_STATUS_SET           (1<<3)
+ 
+ #define MAPTYPE_TXT                 (1<<0)
+ #define MAPTYPE_DBM                 (1<<1)
+@@ -203,6 +205,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define OPTION_IGNORE_INHERIT       (1<<8)
+ #define OPTION_IGNORE_CONTEXT_INFO  (1<<9)
+ #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10)
++#define OPTION_UNSAFE_PREFIX_STAT   (1<<12)
+ 
+ #ifndef RAND_MAX
+ #define RAND_MAX 32767
+@@ -296,6 +299,14 @@ typedef enum {
+     CONDPAT_AP_EXPR
+ } pattern_type;
+ 
++typedef enum {
++  RULE_RC_NOMATCH = 0,      /* the rule didn't match                        */
++  RULE_RC_MATCH = 1,        /* a matching rule w/ substitution              */
++  RULE_RC_NOSUB = 2,        /* a matching rule w/ no substitution           */
++  RULE_RC_STATUS_SET = 3    /* a matching rule that has set an HTTP error
++                               to be returned in r->status */
++} rule_return_type;
++
+ typedef struct {
+     char           *input;   /* Input string of RewriteCond   */
+     char           *pattern; /* the RegExp pattern string     */
+@@ -927,10 +938,15 @@ static void fully_qualify_uri(request_rec *r)
+     return;
+ }
+ 
++static int startsWith(request_rec *r, const char *haystack, const char *needle) {
++    int rc = (ap_strstr_c(haystack, needle) == haystack);
++    rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc));
++    return rc;
++}
+ /*
+- * stat() only the first segment of a path
++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule
+  */
+-static int prefix_stat(const char *path, apr_pool_t *pool)
++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub)
+ {
+     const char *curpath = path;
+     const char *root;
+@@ -964,10 +980,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool)
+         apr_finfo_t sb;
+ 
+         if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) {
+-            return 1;
++            if (!lastsub) {
++                rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath));
++                return 1;
++            }
++
++            rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ",
++                    statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT));
++            if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) {
++                return 1;
++            }
++            else {
++                const char *docroot = ap_document_root(r);
++                const char *context_docroot = ap_context_document_root(r);
++                /*
++                 * As an example, path (r->filename) is /var/foo/bar/baz.html
++                 * even if the flag is not set,  we can accept a rule that
++                 * began with a literal /var (stapath), or if the entire path
++                 * starts with the docroot or context document root
++                 */
++                if (startsWith(r, lastsub->output, statpath) ||
++                        startsWith(r, path, docroot) ||
++                        ((docroot != context_docroot) &&
++                          startsWith(r, path, context_docroot))) {
++                    return 1;
++                }
++            }
+         }
+     }
+ 
++    /* prefix will be added */
+     return 0;
+ }
+ 
+@@ -3046,6 +3088,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd,
+         else if (!strcasecmp(w, "legacyprefixdocroot")) {
+             options |= OPTION_LEGACY_PREFIX_DOCROOT;
+         }
++        else if (!strcasecmp(w, "UnsafePrefixStat")) {
++            options |= OPTION_UNSAFE_PREFIX_STAT;
++        }
+         else {
+             return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
+                                w, "'", NULL);
+@@ -3752,6 +3797,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
+             ++error;
+         }
+         break;
++    case 'u':
++    case 'U':
++        if (!strcasecmp(key, "nsafePrefixStat")){
++            cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT);
++        }
++        else if(!strcasecmp(key, "nsafeAllow3F")) {
++            cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F;
++        }
++        else {
++            ++error;
++        }
++        break;
+     default:
+         ++error;
+         break;
+@@ -4102,7 +4159,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+ /*
+  * Apply a single RewriteRule
+  */
+-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
++static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
++                                           rewrite_ctx *ctx)
+ {
+     ap_regmatch_t regmatch[AP_MAX_REG_MATCH];
+     apr_array_header_t *rewriteconds;
+@@ -4153,7 +4211,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+     rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0);
+     if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||
+            (!rc &&  (p->flags & RULEFLAG_NOTMATCH))   ) ) {
+-        return 0;
++        return RULE_RC_NOMATCH;
+     }
+ 
+     /* It matched, wow! Now it's time to prepare the context structure for
+@@ -4204,7 +4262,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+             }
+         }
+         else if (!rc) {
+-            return 0;
++            return RULE_RC_NOMATCH;
+         }
+ 
+         /* If some HTTP header was involved in the condition, remember it
+@@ -4224,6 +4282,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+         newuri = do_expand(p->output, ctx, p);
+         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+                     newuri));
++        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
++            ap_strcasestr(r->unparsed_uri, "%3f") &&
++            ap_strchr_c(newuri, '?')) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
++                    "Unsafe URL with %%3f URL rewritten without "
++                    "UnsafeAllow3F");
++            r->status = HTTP_FORBIDDEN;
++            return RULE_RC_STATUS_SET;
++        }
+     }
+ 
+     /* expand [E=var:val] and [CO=<cookie>] */
+@@ -4241,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+             r->status = p->forced_responsecode;
+         }
+ 
+-        return 2;
++        return RULE_RC_NOSUB;
+     }
+ 
+     /* Now adjust API's knowledge about r->filename and r->args */
+@@ -4293,7 +4360,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     r->filename));
+ 
+         r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL);
+-        return 1;
++        return RULE_RC_MATCH;
+     }
+ 
+     /* If this rule is explicitly forced for HTTP redirection
+@@ -4308,7 +4375,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     r->filename));
+ 
+         r->status = p->forced_responsecode;
+-        return 1;
++        return RULE_RC_MATCH;
+     }
+ 
+     /* Special Rewriting Feature: Self-Reduction
+@@ -4330,7 +4397,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+                     "with %s", p->forced_responsecode, r->filename));
+ 
+         r->status = p->forced_responsecode;
+-        return 1;
++        return RULE_RC_MATCH;
+     }
+ 
+     /* Finally remember the forced mime-type */
+@@ -4339,7 +4406,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+     /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_)
+      * But now we're done for this particular rule.
+      */
+-    return 1;
++    return RULE_RC_MATCH;
+ }
+ 
+ /*
+@@ -4347,13 +4414,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+  * i.e. a list of rewrite rules
+  */
+ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+-                              char *perdir)
++                              char *perdir, rewriterule_entry **lastsub)
+ {
+     rewriterule_entry *entries;
+     rewriterule_entry *p;
+     int i;
+     int changed;
+-    int rc;
++    rule_return_type rc;
+     int s;
+     rewrite_ctx *ctx;
+     int round = 1;
+@@ -4361,6 +4428,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+     ctx = apr_palloc(r->pool, sizeof(*ctx));
+     ctx->perdir = perdir;
+     ctx->r = r;
++    *lastsub = NULL;
+ 
+     /*
+      *  Iterate over all existing rules
+@@ -4388,7 +4456,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+         ctx->vary = NULL;
+         rc = apply_rewrite_rule(p, ctx);
+ 
+-        if (rc) {
++        if (rc != RULE_RC_NOMATCH) {
++
++            if (!(p->flags & RULEFLAG_NOSUB)) {
++                rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output));
++                *lastsub = p;
++            }
+ 
+             /* Catch looping rules with pathinfo growing unbounded */
+             if ( strlen( r->filename ) > 2*r->server->limit_req_line ) {
+@@ -4408,6 +4481,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+                 apr_table_merge(r->headers_out, "Vary", ctx->vary);
+             }
+ 
++
++            /* Error while evaluating rule, r->status set */
++            if (RULE_RC_STATUS_SET == rc) {
++                return ACTION_STATUS_SET;
++            }
++
+             /*
+              * The rule sets the response code (implies match-only)
+              */
+@@ -4418,7 +4497,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+             /*
+              * Indicate a change if this was not a match-only rule.
+              */
+-            if (rc != 2) {
++            if (rc != RULE_RC_NOSUB) {
+                 changed = ((p->flags & RULEFLAG_NOESCAPE)
+                            ? ACTION_NOESCAPE : ACTION_NORMAL);
+             }
+@@ -4607,6 +4686,7 @@ static int hook_uri2file(request_rec *r)
+     int rulestatus;
+     void *skipdata;
+     const char *oargs;
++    rewriterule_entry *lastsub = NULL;
+ 
+     /*
+      *  retrieve the config structures
+@@ -4718,7 +4798,7 @@ static int hook_uri2file(request_rec *r)
+         /*
+          *  now apply the rules ...
+          */
+-        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL);
++        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub);
+         apr_table_setn(r->notes, "mod_rewrite_rewritten",
+                        apr_psprintf(r->pool,"%d",rulestatus));
+     }
+@@ -4756,6 +4836,9 @@ static int hook_uri2file(request_rec *r)
+             r->status = HTTP_OK;
+             return n;
+         }
++        else if (ACTION_STATUS_SET == rulestatus) {
++            return r->status;
++        }
+ 
+         if (to_proxyreq) {
+             /* it should be go on as an internal proxy request */
+@@ -4875,23 +4958,29 @@ static int hook_uri2file(request_rec *r)
+                 return HTTP_BAD_REQUEST;
+             }
+ 
+-            /* if there is no valid prefix, we call
+-             * the translator from the core and
+-             * prefix the filename with document_root
++            /* We have r->filename as a path in a server-context rewrite without
++             * the PT flag. The historical behavior is to treat it as a verbatim
++             * filesystem path iff the first component of the path exists and is
++             * readable by httpd. Otherwise, it is interpreted as DocumentRoot
++             * relative.
+              *
+              * NOTICE:
+              * We cannot leave out the prefix_stat because
+-             * - when we always prefix with document_root
+-             *   then no absolute path can be created, e.g. via
+-             *   emulating a ScriptAlias directive, etc.
+-             * - when we always NOT prefix with document_root
++             * - If we always prefix with document_root
++             *   then no absolute path can could ever be used in
++             *   a substitution. e.g. emulating an Alias.
++             * - If we never prefix with document_root
+              *   then the files under document_root have to
+              *   be references directly and document_root
+              *   gets never used and will be a dummy parameter -
+-             *   this is also bad
++             *   this is also bad.
++             *   - Later addition: This part is questionable.
++             *     If we had never prefixed, users would just 
++             *     need %{DOCUMENT_ROOT} in substitutions or the 
++             *     [PT] flag.
+              *
+              * BUT:
+-             * Under real Unix systems this is no problem,
++             * Under real Unix systems this is no perf problem,
+              * because we only do stat() on the first directory
+              * and this gets cached by the kernel for along time!
+              */
+@@ -4900,7 +4989,9 @@ static int hook_uri2file(request_rec *r)
+                 uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced");
+             }
+ 
+-            if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) {
++            if (!prefix_stat(r, r->filename, r->pool,
++                             conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub)
++                || uri_reduced != NULL) {
+                 int res;
+                 char *tmp = r->uri;
+ 
+@@ -4945,6 +5036,7 @@ static int hook_fixup(request_rec *r)
+     char *ofilename, *oargs;
+     int is_proxyreq;
+     void *skipdata;
++    rewriterule_entry *lastsub;
+ 
+     dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config,
+                                                         &rewrite_module);
+@@ -5029,7 +5121,7 @@ static int hook_fixup(request_rec *r)
+     /*
+      *  now apply the rules ...
+      */
+-    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
++    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub);
+     if (rulestatus) {
+         unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
+         int to_proxyreq = 0;
+@@ -5058,6 +5150,9 @@ static int hook_fixup(request_rec *r)
+             r->status = HTTP_OK;
+             return n;
+         }
++        else if (ACTION_STATUS_SET == rulestatus) {
++            return r->status;
++        }
+ 
+         if (to_proxyreq) {
+             /* it should go on as an internal proxy request */

SOURCES/httpd-2.4.37-CVE-2024-38476.patch

@@ -0,0 +1,301 @@
+
+-- backported bnotes needed by this CVE fix from https://svn.apache.org/viewvc?view=revision&revision=1887384
+-- modified it a little bit so it actually doesn't store bnotes into req structure to not brake compatibility
+-- but it stores AP_REQUEST_TRUSTED_CT info into r->notes
+
+diff --git a/include/http_protocol.h b/include/http_protocol.h
+index 8ed77ac..81949ca 100644
+--- a/include/http_protocol.h
++++ b/include/http_protocol.h
+@@ -402,6 +402,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l);
+  */
+ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct);
+ 
++/**
++ * Set the content type for this request (r->content_type).
++ * @param r The current request
++ * @param ct The new content type
++ * @param trusted If non-zero, The content-type should come from a
++ *        trusted source such as server configuration rather
++ *        than application output.
++ * for the AddOutputFilterByType directive to work correctly.
++ */
++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted);
++
+ /**
+  * Set the Accept-Ranges header for this response
+  * @param r The current request
+diff --git a/include/httpd.h b/include/httpd.h
+index 99f7f04..d8746c1 100644
+--- a/include/httpd.h
++++ b/include/httpd.h
+@@ -645,6 +645,7 @@ struct ap_method_list_t {
+     /** the array used for extension methods */
+     apr_array_header_t *method_list;
+ };
++/** @} */
+ 
+ /**
+  * @defgroup module_magic Module Magic mime types
+@@ -715,6 +716,31 @@ struct ap_method_list_t {
+ 
+ /** @} // values_request_rec_used_path_info */
+ 
++#define AP_REQUEST_TRUSTED_CT  "rh-bnotes-trusted-ct"
++
++/**
++ * This is a convenience macro to ease with getting specific request
++ * binary notes.
++ */
++#define AP_REQUEST_GET_BNOTE(r, mask) (apr_table_get(r->notes, mask) ? 1 : 0)
++
++/**
++ * This is a convenience macro to ease with setting specific request
++ * binary notes.
++ */
++#define AP_REQUEST_SET_BNOTE(r, mask, val) do { \
++    if (val)                                    \
++        apr_table_setn(r->notes, mask, "1");    \
++    else                                        \
++        apr_table_unset(r->notes, mask);        \
++} while (0)
++
++/**
++ * Returns true if the content-type field is from a trusted source
++ */
++#define AP_REQUEST_IS_TRUSTED_CT(r) \
++    (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT))
++/** @} */
+ 
+ /*
+  * Things which may vary per file-lookup WITHIN a request ---
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index df862e0..d003aea 100644
+--- a/modules/http/http_protocol.c
++++ b/modules/http/http_protocol.c
+@@ -1077,8 +1077,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct)
+     }
+     else if (!r->content_type || strcmp(r->content_type, ct)) {
+         r->content_type = ct;
++        AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0);
+     }
+ }
++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted)
++{
++    ap_set_content_type(r, ct);
++    AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0);
++}
+ 
+ AP_DECLARE(void) ap_set_accept_ranges(request_rec *r)
+ {
+diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c
+index 28c53be..4cd1c48 100644
+--- a/modules/http/mod_mime.c
++++ b/modules/http/mod_mime.c
+@@ -759,7 +759,7 @@ static int find_ct(request_rec *r)
+     int found_metadata = 0;
+ 
+     if (r->finfo.filetype == APR_DIR) {
+-        ap_set_content_type(r, DIR_MAGIC_TYPE);
++        ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1);
+         return OK;
+     }
+ 
+@@ -837,7 +837,7 @@ static int find_ct(request_rec *r)
+         if (exinfo == NULL || !exinfo->forced_type) {
+             if ((type = apr_hash_get(mime_type_extensions, ext,
+                                      APR_HASH_KEY_STRING)) != NULL) {
+-                ap_set_content_type(r, (char*) type);
++                ap_set_content_type_ex(r, (char*) type, 1);
+                 found = 1;
+             }
+         }
+@@ -846,7 +846,7 @@ static int find_ct(request_rec *r)
+ 
+             /* empty string is treated as special case for RemoveType */
+             if (exinfo->forced_type && *exinfo->forced_type) {
+-                ap_set_content_type(r, exinfo->forced_type);
++                ap_set_content_type_ex(r, exinfo->forced_type, 1);
+                 found = 1;
+             }
+ 
+@@ -951,33 +951,33 @@ static int find_ct(request_rec *r)
+             memcpy(tmp, ctp->subtype, ctp->subtype_len);
+             tmp += ctp->subtype_len;
+             *tmp = 0;
+-            ap_set_content_type(r, base_content_type);
++            ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+             while (pp != NULL) {
+                 if (charset && !strcmp(pp->attr, "charset")) {
+                     if (!override) {
+-                        ap_set_content_type(r,
++                        ap_set_content_type_ex(r,
+                                             apr_pstrcat(r->pool,
+                                                         r->content_type,
+                                                         "; charset=",
+                                                         charset,
+-                                                        NULL));
++                                                        NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+                         override = 1;
+                     }
+                 }
+                 else {
+-                    ap_set_content_type(r,
++                    ap_set_content_type_ex(r,
+                                         apr_pstrcat(r->pool,
+                                                     r->content_type,
+                                                     "; ", pp->attr,
+                                                     "=", pp->val,
+-                                                    NULL));
++                                                    NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+                 }
+                 pp = pp->next;
+             }
+             if (charset && !override) {
+-                ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type,
++                ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type,
+                                                    "; charset=", charset,
+-                                                   NULL));
++                                                   NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+             }
+         }
+     }
+diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c
+index ac9c3b7..5e398b5 100644
+--- a/modules/mappers/mod_actions.c
++++ b/modules/mappers/mod_actions.c
+@@ -182,8 +182,10 @@ static int action_handler(request_rec *r)
+         return DECLINED;
+ 
+     /* Second, check for actions (which override the method scripts) */
+-    action = r->handler ? r->handler :
+-        ap_field_noparam(r->pool, r->content_type);
++    action = r->handler;
++    if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) {
++        action = ap_field_noparam(r->pool, r->content_type);
++    }
+ 
+     if (action && (t = apr_table_get(conf->action_types, action))) {
+         int virtual = (*t++ == '0' ? 0 : 1);
+diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c
+index da68353..e91ba5f 100644
+--- a/modules/mappers/mod_negotiation.c
++++ b/modules/mappers/mod_negotiation.c
+@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg)
+          * might be doing.
+          */
+         if (sub_req->handler && !sub_req->content_type) {
+-            ap_set_content_type(sub_req, CGI_MAGIC_TYPE);
++            ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1);
+         }
+ 
+         /*
+@@ -3008,14 +3008,14 @@ static int handle_map_file(request_rec *r)
+         /* set MIME type and charset as negotiated */
+         if (best->mime_type && *best->mime_type) {
+             if (best->content_charset && *best->content_charset) {
+-                ap_set_content_type(r, apr_pstrcat(r->pool,
++                ap_set_content_type_ex(r, apr_pstrcat(r->pool,
+                                                    best->mime_type,
+                                                    "; charset=",
+                                                    best->content_charset,
+-                                                   NULL));
++                                                   NULL), 1);
+             }
+             else {
+-                ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type));
++                ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1);
+             }
+         }
+ 
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index a25c7ae..2b70d66 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -5477,7 +5477,7 @@ static int hook_mimetype(request_rec *r)
+         rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'",
+                     r->filename, t));
+ 
+-        ap_set_content_type(r, t);
++        ap_set_content_type_ex(r, t, 1);
+     }
+ 
+     /* handler */
+diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c
+index 1ea970d..55ab281 100644
+--- a/modules/metadata/mod_headers.c
++++ b/modules/metadata/mod_headers.c
+@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+             break;
+         case hdr_set:
+             if (!strcasecmp(hdr->header, "Content-Type")) {
+-                 ap_set_content_type(r, process_tags(hdr, r));
++                 ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+             }
+             apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+             break;
+         case hdr_setifempty:
+             if (NULL == apr_table_get(headers, hdr->header)) {
+                 if (!strcasecmp(hdr->header, "Content-Type")) {
+-                    ap_set_content_type(r, process_tags(hdr, r));
++                    ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+                 }
+                 apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+             }
+@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+                 const char *repl = process_regexp(hdr, r->content_type, r);
+                 if (repl == NULL)
+                     return 0;
+-                ap_set_content_type(r, repl);
++                ap_set_content_type_ex(r, repl, 1);
+             }
+             if (apr_table_get(headers, hdr->header)) {
+                 edit_do ed;
+diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c
+index c12529a..fe30f27 100644
+--- a/modules/metadata/mod_mime_magic.c
++++ b/modules/metadata/mod_mime_magic.c
+@@ -789,7 +789,7 @@ static int magic_rsl_to_request(request_rec *r)
+     /* XXX: this could be done at config time I'm sure... but I'm
+      * confused by all this magic_rsl stuff. -djg */
+     ap_content_type_tolower(tmp);
+-    ap_set_content_type(r, tmp);
++    ap_set_content_type_ex(r, tmp, 1);
+ 
+     if (state == rsl_encoding) {
+         tmp = rsl_strdup(r, encoding_frag,
+@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r)
+ 
+     /* extract content type/encoding/language from sub-request */
+     if (sub->content_type) {
+-        ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type));
++        ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1);
+ #if MIME_MAGIC_DEBUG
+         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557)
+                     MODNAME ": subrequest %s got %s",
+diff --git a/server/config.c b/server/config.c
+index f815b22..fc4d76b 100644
+--- a/server/config.c
++++ b/server/config.c
+@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r)
+     }
+ 
+     if (!r->handler) {
+-        if (r->content_type) {
++        if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) {
+             handler = r->content_type;
+             if ((p=ap_strchr_c(handler, ';')) != NULL) {
+                 char *new_handler = (char *)apr_pmemdup(r->pool, handler,
+diff --git a/server/core.c b/server/core.c
+index 8575aae..82706cf 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -4722,7 +4722,7 @@ static int core_override_type(request_rec *r)
+     /* Check for overrides with ForceType / SetHandler
+      */
+     if (conf->mime_type && strcmp(conf->mime_type, "none"))
+-        ap_set_content_type(r, (char*) conf->mime_type);
++        ap_set_content_type_ex(r, (char*) conf->mime_type, 1);
+ 
+     if (conf->expr_handler) { 
+         const char *err;

SOURCES/httpd-2.4.37-CVE-2024-38477.patch

@@ -0,0 +1,29 @@
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 6244e74..f5c3283 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -2406,6 +2406,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r,
+                              apr_pstrcat(p,"URI cannot be parsed: ", *url,
+                                          NULL));
+     }
++
++    if (!uri->hostname) {
++        return ap_proxyerror(r, HTTP_BAD_REQUEST,
++                             apr_pstrcat(p,"URI has no hostname: ", *url,
++                                         NULL));
++    }
++
+     if (!uri->port) {
+         uri->port = ap_proxy_port_of_scheme(uri->scheme);
+     }
+@@ -3727,6 +3734,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+      * way. No telling which legacy backend is relying no this.
+      */
+     if (dconf->preserve_host == 0) {
++        if (!uri->hostname) {
++            rc = HTTP_BAD_REQUEST;
++            goto cleanup;
++        }
+         if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
+             if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
+                 buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:",

SOURCES/httpd-2.4.37-CVE-2024-39573.patch

@@ -0,0 +1,56 @@
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 797f093..114b126 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -4311,6 +4311,32 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+         return RULE_RC_NOSUB;
+     }
+ 
++    /* Add the previously stripped per-directory location prefix, unless
++     * (1) it's an absolute URL path and
++     * (2) it's a full qualified URL
++     */
++    if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
++        if (ctx->perdir) {
++            rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
++                       newuri, ctx->perdir, newuri));
++
++            newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
++        }
++        else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
++            /* Not an absolute URI-path and the scheme (if any) is unknown,
++             * and it won't be passed to fully_qualify_uri() below either,
++             * so add an implicit '/' prefix. This avoids potentially a common
++             * rule like "RewriteRule ^/some/path(.*) $1" that is given a path
++             * like "/some/pathscheme:..." to produce the fully qualified URL
++             * "scheme:..." which could be misinterpreted later.
++             */
++            rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s",
++                       newuri, newuri));
++
++            newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
++        }
++    }
++
+     /* Now adjust API's knowledge about r->filename and r->args */
+     r->filename = newuri;
+ 
+@@ -4320,18 +4346,6 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+ 
+     splitout_queryargs(r, p->flags);
+ 
+-    /* Add the previously stripped per-directory location prefix, unless
+-     * (1) it's an absolute URL path and
+-     * (2) it's a full qualified URL
+-     */
+-    if (   ctx->perdir && !is_proxyreq && *r->filename != '/'
+-        && !is_absolute_uri(r->filename, NULL)) {
+-        rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+-                    r->filename, ctx->perdir, r->filename));
+-
+-        r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL);
+-    }
+-
+     /* If this rule is forced for proxy throughput
+      * (`RewriteRule ... ... [P]') then emulate mod_proxy's
+      * URL-to-filename handler to be sure mod_proxy is triggered

SOURCES/httpd-2.4.37-CVE-2024-39884+.patch

@@ -0,0 +1,266 @@
+diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c
+index 965fef5..6df3bf4 100644
+--- a/modules/cluster/mod_heartmonitor.c
++++ b/modules/cluster/mod_heartmonitor.c
+@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r)
+     hmserver.seen = apr_time_now();
+     hm_update_stat(ctx, &hmserver, r->pool);
+ 
+-    ap_set_content_type(r, "text/plain");
++    ap_set_content_type_ex(r, "text/plain", 1);
+     ap_set_content_length(r, 2);
+     ap_rputs("OK", r);
+     ap_rflush(r);
+diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c
+index 792b514..28479b9 100644
+--- a/modules/dav/main/mod_dav.c
++++ b/modules/dav/main/mod_dav.c
+@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
+     r->status = status;
+     r->status_line = ap_get_status_line(status);
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     /* begin the response now... */
+     ap_rvputs(r,
+@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r,
+ {
+     r->status = err->status;
+ 
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     ap_rputs(DAV_XML_HEADER DEBUG_CR
+              "<D:error xmlns:D=\"DAV:\"", r);
+@@ -512,7 +512,7 @@ DAV_DECLARE(void) dav_begin_multistatus(apr_bucket_brigade *bb,
+ {
+     /* Set the correct status and Content-Type */
+     r->status = status;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     /* Send the headers and actual multistatus response now... */
+     ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR
+@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r)
+ 
+     /* send the options response */
+     r->status = HTTP_OK;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     /* send the headers and response body */
+     ap_rputs(DAV_XML_HEADER DEBUG_CR
+@@ -3191,7 +3191,7 @@ static int dav_method_lock(request_rec *r)
+     (*locks_hooks->close_lockdb)(lockdb);
+ 
+     r->status = HTTP_OK;
+-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+ 
+     ap_rputs(DAV_XML_HEADER DEBUG_CR "<D:prop xmlns:D=\"DAV:\">" DEBUG_CR, r);
+     if (lock == NULL)
+diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c
+index d818dc1..4d79b86 100644
+--- a/modules/examples/mod_example_hooks.c
++++ b/modules/examples/mod_example_hooks.c
+@@ -993,7 +993,7 @@ static int x_handler(request_rec *r)
+      * Set the Content-type header. Note that we do not actually have to send
+      * the headers: this is done by the http core.
+      */
+-    ap_set_content_type(r, "text/html");
++    ap_set_content_type_ex(r, "text/html", 1);
+     /*
+      * If we're only supposed to send header information (HEAD request), we're
+      * already there.
+diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c
+index d083d32..489e76c 100644
+--- a/modules/filters/mod_data.c
++++ b/modules/filters/mod_data.c
+@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+             }
+         }
+ 
+-        ap_set_content_type(r, "text/plain");
++        ap_set_content_type_ex(r, "text/plain", 1);
+ 
+     }
+ 
+diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
+index a46a944..05f994c 100644
+--- a/modules/filters/mod_include.c
++++ b/modules/filters/mod_include.c
+@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r)
+     if (r->handler && (strcmp(r->handler, "server-parsed") == 0))
+     {
+         if (!r->content_type || !*r->content_type) {
+-            ap_set_content_type(r, "text/html");
++            ap_set_content_type_ex(r, "text/html", 1);
+         }
+         r->handler = "default-handler";
+     }
+diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
+index ea6bf03..8b619e8 100644
+--- a/modules/filters/mod_proxy_html.c
++++ b/modules/filters/mod_proxy_html.c
+@@ -933,7 +933,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+                         ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422)
+                                       "No i18n support found.  Install mod_xml2enc if required");
+                     enc = XML_CHAR_ENCODING_NONE;
+-                    ap_set_content_type(f->r, "text/html;charset=utf-8");
++                    ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+                 }
+                 else {
+                     /* if we wanted a non-default charset_out, insert the
+@@ -949,7 +949,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+                                                         cenc, NULL));
+                     }
+                     else /* Normal case, everything worked, utf-8 output */
+-                        ap_set_content_type(f->r, "text/html;charset=utf-8");
++                        ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+                 }
+ 
+                 ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype);
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 66cd31c..4650d18 100644
+--- a/modules/generators/mod_cgi.c
++++ b/modules/generators/mod_cgi.c
+@@ -795,7 +795,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+     /* Force sub_req to be treated as a CGI request, even if ordinary
+      * typing rules would have called it something else.
+      */
+-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
++    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+ 
+     /* Run it. */
+     rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index 102d2b3..57e119f 100644
+--- a/modules/generators/mod_cgid.c
++++ b/modules/generators/mod_cgid.c
+@@ -1801,7 +1801,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+     /* Force sub_req to be treated as a CGI request, even if ordinary
+      * typing rules would have called it something else.
+      */
+-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
++    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+ 
+     /* Run it. */
+     rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c
+index e5e63de..67df675 100644
+--- a/modules/generators/mod_info.c
++++ b/modules/generators/mod_info.c
+@@ -777,7 +777,7 @@ static int display_info(request_rec * r)
+         return DECLINED;
+     }
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     ap_rputs(DOCTYPE_XHTML_1_0T
+              "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n"
+diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
+index 5bada07..2cb38c7 100644
+--- a/modules/generators/mod_status.c
++++ b/modules/generators/mod_status.c
+@@ -273,7 +273,7 @@ static int status_handler(request_rec *r)
+     if (r->method_number != M_GET)
+         return DECLINED;
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     /*
+      * Simple table-driven form data set parser that lets you alter the header
+@@ -301,7 +301,7 @@ static int status_handler(request_rec *r)
+                     no_table_report = 1;
+                     break;
+                 case STAT_OPT_AUTO:
+-                    ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
++                    ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1);
+                     short_report = 1;
+                     break;
+                 }
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index 16cb23c..27c44b2 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -1245,7 +1245,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r)
+         }
+     }
+ 
+-    ap_set_content_type(r, "message/http");
++    ap_set_content_type_ex(r, "message/http", 1);
+ 
+     /* Now we recreate the request, and echo it back */
+ 
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index 417fee6..d003aea 100644
+--- a/modules/http/http_protocol.c
++++ b/modules/http/http_protocol.c
+@@ -1423,10 +1423,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error)
+             request_conf->suppress_charset = 1; /* avoid adding default
+                                                  * charset later
+                                                  */
+-            ap_set_content_type(r, "text/html");
++            ap_set_content_type_ex(r, "text/html", 1);
+         }
+         else {
+-            ap_set_content_type(r, "text/html; charset=iso-8859-1");
++            ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1);
+         }
+ 
+         if ((status == HTTP_METHOD_NOT_ALLOWED)
+diff --git a/modules/http/http_request.c b/modules/http/http_request.c
+index e873aab..3521cfb 100644
+--- a/modules/http/http_request.c
++++ b/modules/http/http_request.c
+@@ -709,7 +709,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
+     r->args = rr->args;
+     r->finfo = rr->finfo;
+     r->handler = rr->handler;
+-    ap_set_content_type(r, rr->content_type);
++    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(rr));
+     r->content_encoding = rr->content_encoding;
+     r->content_languages = rr->content_languages;
+     r->per_dir_config = rr->per_dir_config;
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index eecb3f7..b71dc98 100644
+--- a/modules/ldap/util_ldap.c
++++ b/modules/ldap/util_ldap.c
+@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r)
+     st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,
+             &ldap_module);
+ 
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     if (r->header_only)
+         return OK;
+diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c
+index 187a500..3e14933 100644
+--- a/modules/mappers/mod_imagemap.c
++++ b/modules/mappers/mod_imagemap.c
+@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect)
+ 
+ static void menu_header(request_rec *r, char *menu)
+ {
+-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+ 
+     ap_rvputs(r, DOCTYPE_HTML_3_2, "<html><head>\n<title>Menu for ",
+               ap_escape_html(r->pool, r->uri),
+diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
+index c599e1a..d5c20af 100644
+--- a/modules/proxy/mod_proxy_balancer.c
++++ b/modules/proxy/mod_proxy_balancer.c
+@@ -1480,7 +1480,7 @@ static int balancer_handler(request_rec *r)
+ 
+     if (apr_table_get(params, "xml")) {
+         char date[APR_RFC822_DATE_LEN];
+-        ap_set_content_type(r, "text/xml");
++        ap_set_content_type_ex(r, "text/xml", 1);
+         ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r);
+         ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r);
+         ap_rputs("  <httpd:balancers>\n", r);

SOURCES/httpd-2.4.37-mod_status-duplicate-key.patch

@@ -0,0 +1,170 @@
+commit 84e6f25f67de9a9bddefdcdbfee3f251fead647e
+Author: Tomas Korbar <tkorbar@redhat.com>
+Date:   Thu Jul 20 14:41:33 2023 +0200
+
+    Fix duplicate presence of keys printed by mod_status
+
+diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
+index 5917953..5bada07 100644
+--- a/modules/generators/mod_status.c
++++ b/modules/generators/mod_status.c
+@@ -186,7 +186,8 @@ static int status_handler(request_rec *r)
+     apr_uint32_t up_time;
+     ap_loadavg_t t;
+     int j, i, res, written;
+-    int ready;
++    int idle;
++    int graceful;
+     int busy;
+     unsigned long count;
+     unsigned long lres, my_lres, conn_lres;
+@@ -203,6 +204,7 @@ static int status_handler(request_rec *r)
+     char *stat_buffer;
+     pid_t *pid_buffer, worker_pid;
+     int *thread_idle_buffer = NULL;
++    int *thread_graceful_buffer = NULL;
+     int *thread_busy_buffer = NULL;
+     clock_t tu, ts, tcu, tcs;
+     clock_t gu, gs, gcu, gcs;
+@@ -231,7 +233,8 @@ static int status_handler(request_rec *r)
+ #endif
+ #endif
+ 
+-    ready = 0;
++    idle = 0;
++    graceful = 0;
+     busy = 0;
+     count = 0;
+     bcount = 0;
+@@ -250,6 +253,7 @@ static int status_handler(request_rec *r)
+     stat_buffer = apr_palloc(r->pool, server_limit * thread_limit * sizeof(char));
+     if (is_async) {
+         thread_idle_buffer = apr_palloc(r->pool, server_limit * sizeof(int));
++        thread_graceful_buffer = apr_palloc(r->pool, server_limit * sizeof(int));
+         thread_busy_buffer = apr_palloc(r->pool, server_limit * sizeof(int));
+     }
+ 
+@@ -318,6 +322,7 @@ static int status_handler(request_rec *r)
+         ps_record = ap_get_scoreboard_process(i);
+         if (is_async) {
+             thread_idle_buffer[i] = 0;
++            thread_graceful_buffer[i] = 0;
+             thread_busy_buffer[i] = 0;
+         }
+         for (j = 0; j < thread_limit; ++j) {
+@@ -336,18 +341,20 @@ static int status_handler(request_rec *r)
+                 && ps_record->pid) {
+                 if (res == SERVER_READY) {
+                     if (ps_record->generation == mpm_generation)
+-                        ready++;
++                        idle++;
+                     if (is_async)
+                         thread_idle_buffer[i]++;
+                 }
+                 else if (res != SERVER_DEAD &&
+                          res != SERVER_STARTING &&
+                          res != SERVER_IDLE_KILL) {
+-                    busy++;
+-                    if (is_async) {
+-                        if (res == SERVER_GRACEFUL)
+-                            thread_idle_buffer[i]++;
+-                        else
++                    if (res == SERVER_GRACEFUL) {
++                        graceful++;
++                        if (is_async)
++                            thread_graceful_buffer[i]++;
++                    } else {
++                        busy++;
++                        if (is_async)
+                             thread_busy_buffer[i]++;
+                     }
+                 }
+@@ -548,10 +555,10 @@ static int status_handler(request_rec *r)
+     } /* ap_extended_status */
+ 
+     if (!short_report)
+-        ap_rprintf(r, "<dt>%d requests currently being processed, "
+-                      "%d idle workers</dt>\n", busy, ready);
++        ap_rprintf(r, "<dt>%d requests currently being processed, %d workers gracefully restarting, "
++                      "%d idle workers</dt>\n", busy, graceful, idle);
+     else
+-        ap_rprintf(r, "BusyWorkers: %d\nIdleWorkers: %d\n", busy, ready);
++        ap_rprintf(r, "BusyWorkers: %d\nGracefulWorkers: %d\nIdleWorkers: %d\n", busy, graceful, idle);
+ 
+     if (!short_report)
+         ap_rputs("</dl>", r);
+@@ -559,11 +566,6 @@ static int status_handler(request_rec *r)
+     if (is_async) {
+         int write_completion = 0, lingering_close = 0, keep_alive = 0,
+             connections = 0, stopping = 0, procs = 0;
+-        /*
+-         * These differ from 'busy' and 'ready' in how gracefully finishing
+-         * threads are counted. XXX: How to make this clear in the html?
+-         */
+-        int busy_workers = 0, idle_workers = 0;
+         if (!short_report)
+             ap_rputs("\n\n<table rules=\"all\" cellpadding=\"1%\">\n"
+                      "<tr><th rowspan=\"2\">Slot</th>"
+@@ -573,7 +575,7 @@ static int status_handler(request_rec *r)
+                          "<th colspan=\"2\">Threads</th>"
+                          "<th colspan=\"3\">Async connections</th></tr>\n"
+                      "<tr><th>total</th><th>accepting</th>"
+-                         "<th>busy</th><th>idle</th>"
++                         "<th>busy</th><th>graceful</th><th>idle</th>"
+                          "<th>writing</th><th>keep-alive</th><th>closing</th></tr>\n", r);
+         for (i = 0; i < server_limit; ++i) {
+             ps_record = ap_get_scoreboard_process(i);
+@@ -582,8 +584,6 @@ static int status_handler(request_rec *r)
+                 write_completion += ps_record->write_completion;
+                 keep_alive       += ps_record->keep_alive;
+                 lingering_close  += ps_record->lingering_close;
+-                busy_workers     += thread_busy_buffer[i];
+-                idle_workers     += thread_idle_buffer[i];
+                 procs++;
+                 if (ps_record->quiescing) {
+                     stopping++;
+@@ -599,7 +599,7 @@ static int status_handler(request_rec *r)
+                     ap_rprintf(r, "<tr><td>%u</td><td>%" APR_PID_T_FMT "</td>"
+                                       "<td>%s%s</td>"
+                                       "<td>%u</td><td>%s</td>"
+-                                      "<td>%u</td><td>%u</td>"
++                                      "<td>%u</td><td>%u</td><td>%u</td>"
+                                       "<td>%u</td><td>%u</td><td>%u</td>"
+                                       "</tr>\n",
+                                i, ps_record->pid,
+@@ -607,6 +607,7 @@ static int status_handler(request_rec *r)
+                                ps_record->connections,
+                                ps_record->not_accepting ? "no" : "yes",
+                                thread_busy_buffer[i],
++                               thread_graceful_buffer[i],
+                                thread_idle_buffer[i],
+                                ps_record->write_completion,
+                                ps_record->keep_alive,
+@@ -618,25 +619,22 @@ static int status_handler(request_rec *r)
+             ap_rprintf(r, "<tr><td>Sum</td>"
+                           "<td>%d</td><td>%d</td>"
+                           "<td>%d</td><td>&nbsp;</td>"
+-                          "<td>%d</td><td>%d</td>"
++                          "<td>%d</td><td>%d</td><td>%d</td>"
+                           "<td>%d</td><td>%d</td><td>%d</td>"
+                           "</tr>\n</table>\n",
+                           procs, stopping,
+                           connections,
+-                          busy_workers, idle_workers,
++                          busy, graceful, idle,
+                           write_completion, keep_alive, lingering_close);
+         }
+         else {
+             ap_rprintf(r, "Processes: %d\n"
+                           "Stopping: %d\n"
+-                          "BusyWorkers: %d\n"
+-                          "IdleWorkers: %d\n"
+                           "ConnsTotal: %d\n"
+                           "ConnsAsyncWriting: %d\n"
+                           "ConnsAsyncKeepAlive: %d\n"
+                           "ConnsAsyncClosing: %d\n",
+                           procs, stopping,
+-                          busy_workers, idle_workers,
+                           connections,
+                           write_completion, keep_alive, lingering_close);
+         }

SOURCES/httpd-2.4.37-r1885607.patch

@@ -0,0 +1,849 @@
+diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
+index fbbd508..8fcd26d 100644
+--- a/modules/proxy/mod_proxy.h
++++ b/modules/proxy/mod_proxy.h
+@@ -1168,6 +1168,55 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+                                            char **old_cl_val,
+                                            char **old_te_val);
+ 
++/**
++ * Prefetch the client request body (in memory), up to a limit.
++ * Read what's in the client pipe. If nonblocking is set and read is EAGAIN,
++ * pass a FLUSH bucket to the backend and read again in blocking mode.
++ * @param r             client request
++ * @param backend       backend connection
++ * @param input_brigade input brigade to use/fill
++ * @param block         blocking or non-blocking mode
++ * @param bytes_read    number of bytes read
++ * @param max_read      maximum number of bytes to read
++ * @return              OK or HTTP_* error code
++ * @note max_read is rounded up to APR_BUCKET_BUFF_SIZE
++ */
++PROXY_DECLARE(int) ap_proxy_prefetch_input(request_rec *r,
++                                           proxy_conn_rec *backend,
++                                           apr_bucket_brigade *input_brigade,
++                                           apr_read_type_e block,
++                                           apr_off_t *bytes_read,
++                                           apr_off_t max_read);
++
++/**
++ * Spool the client request body to memory, or disk above given limit.
++ * @param r             client request
++ * @param backend       backend connection
++ * @param input_brigade input brigade to use/fill
++ * @param bytes_spooled number of bytes spooled
++ * @param max_mem_spool maximum number of in-memory bytes
++ * @return              OK or HTTP_* error code
++ */
++PROXY_DECLARE(int) ap_proxy_spool_input(request_rec *r,
++                                        proxy_conn_rec *backend,
++                                        apr_bucket_brigade *input_brigade,
++                                        apr_off_t *bytes_spooled,
++                                        apr_off_t max_mem_spool);
++
++/**
++ * Read what's in the client pipe. If the read would block (EAGAIN),
++ * pass a FLUSH bucket to the backend and read again in blocking mode.
++ * @param r             client request
++ * @param backend       backend connection
++ * @param input_brigade brigade to use/fill
++ * @param max_read      maximum number of bytes to read
++ * @return              OK or HTTP_* error code
++ */
++PROXY_DECLARE(int) ap_proxy_read_input(request_rec *r,
++                                       proxy_conn_rec *backend,
++                                       apr_bucket_brigade *input_brigade,
++                                       apr_off_t max_read);
++
+ /**
+  * @param bucket_alloc  bucket allocator
+  * @param r             request
+diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
+index 2e97408..f9cf716 100644
+--- a/modules/proxy/mod_proxy_fcgi.c
++++ b/modules/proxy/mod_proxy_fcgi.c
+@@ -521,7 +521,8 @@ static int handle_headers(request_rec *r, int *state,
+ static apr_status_t dispatch(proxy_conn_rec *conn, proxy_dir_conf *conf,
+                              request_rec *r, apr_pool_t *setaside_pool,
+                              apr_uint16_t request_id, const char **err,
+-                             int *bad_request, int *has_responded)
++                             int *bad_request, int *has_responded,
++                             apr_bucket_brigade *input_brigade)
+ {
+     apr_bucket_brigade *ib, *ob;
+     int seen_end_of_headers = 0, done = 0, ignore_body = 0;
+@@ -583,9 +584,26 @@ static apr_status_t dispatch(proxy_conn_rec *conn, proxy_dir_conf *conf,
+             int last_stdin = 0;
+             char *iobuf_cursor;
+ 
+-            rv = ap_get_brigade(r->input_filters, ib,
+-                                AP_MODE_READBYTES, APR_BLOCK_READ,
+-                                iobuf_size);
++            if (APR_BRIGADE_EMPTY(input_brigade)) {
++                rv = ap_get_brigade(r->input_filters, ib,
++                                    AP_MODE_READBYTES, APR_BLOCK_READ,
++                                    iobuf_size);
++            }
++            else {
++                apr_bucket *e;
++                APR_BRIGADE_CONCAT(ib, input_brigade);
++                rv = apr_brigade_partition(ib, iobuf_size, &e);
++                if (rv == APR_SUCCESS) {
++                    while (e != APR_BRIGADE_SENTINEL(ib)
++                           && APR_BUCKET_IS_METADATA(e)) {
++                        e = APR_BUCKET_NEXT(e);
++                    }
++                    apr_brigade_split_ex(ib, e, input_brigade);
++                }
++                else if (rv == APR_INCOMPLETE) {
++                    rv = APR_SUCCESS;
++                }
++            }
+             if (rv != APR_SUCCESS) {
+                 *err = "reading input brigade";
+                 *bad_request = 1;
+@@ -924,7 +942,8 @@ static int fcgi_do_request(apr_pool_t *p, request_rec *r,
+                            conn_rec *origin,
+                            proxy_dir_conf *conf,
+                            apr_uri_t *uri,
+-                           char *url, char *server_portstr)
++                           char *url, char *server_portstr,
++                           apr_bucket_brigade *input_brigade)
+ {
+     /* Request IDs are arbitrary numbers that we assign to a
+      * single request. This would allow multiplex/pipelining of
+@@ -960,7 +979,8 @@ static int fcgi_do_request(apr_pool_t *p, request_rec *r,
+ 
+     /* Step 3: Read records from the back end server and handle them. */
+     rv = dispatch(conn, conf, r, temp_pool, request_id,
+-                  &err, &bad_request, &has_responded);
++                  &err, &bad_request, &has_responded,
++                  input_brigade);
+     if (rv != APR_SUCCESS) {
+         /* If the client aborted the connection during retrieval or (partially)
+          * sending the response, don't return a HTTP_SERVICE_UNAVAILABLE, since
+@@ -996,6 +1016,8 @@ static int fcgi_do_request(apr_pool_t *p, request_rec *r,
+ 
+ #define FCGI_SCHEME "FCGI"
+ 
++#define MAX_MEM_SPOOL 16384
++
+ /*
+  * This handles fcgi:(dest) URLs
+  */
+@@ -1008,6 +1030,8 @@ static int proxy_fcgi_handler(request_rec *r, proxy_worker *worker,
+     char server_portstr[32];
+     conn_rec *origin = NULL;
+     proxy_conn_rec *backend = NULL;
++    apr_bucket_brigade *input_brigade;
++    apr_off_t input_bytes = 0;
+     apr_uri_t *uri;
+ 
+     proxy_dir_conf *dconf = ap_get_module_config(r->per_dir_config,
+@@ -1050,6 +1074,101 @@ static int proxy_fcgi_handler(request_rec *r, proxy_worker *worker,
+         goto cleanup;
+     }
+ 
++    /* We possibly reuse input data prefetched in previous call(s), e.g. for a
++     * balancer fallback scenario.
++     */
++    apr_pool_userdata_get((void **)&input_brigade, "proxy-fcgi-input", p);
++    if (input_brigade == NULL) {
++        const char *old_te = apr_table_get(r->headers_in, "Transfer-Encoding");
++        const char *old_cl = NULL;
++        if (old_te) {
++            apr_table_unset(r->headers_in, "Content-Length");
++        }
++        else {
++            old_cl = apr_table_get(r->headers_in, "Content-Length");
++        }
++
++        input_brigade = apr_brigade_create(p, r->connection->bucket_alloc);
++        apr_pool_userdata_setn(input_brigade, "proxy-fcgi-input", NULL, p);
++
++        /* Prefetch (nonlocking) the request body so to increase the chance
++         * to get the whole (or enough) body and determine Content-Length vs
++         * chunked or spooled. By doing this before connecting or reusing the
++         * backend, we want to minimize the delay between this connection is
++         * considered alive and the first bytes sent (should the client's link
++         * be slow or some input filter retain the data). This is a best effort
++         * to prevent the backend from closing (from under us) what it thinks is
++         * an idle connection, hence to reduce to the minimum the unavoidable
++         * local is_socket_connected() vs remote keepalive race condition.
++         */
++        status = ap_proxy_prefetch_input(r, backend, input_brigade,
++                                         APR_NONBLOCK_READ, &input_bytes,
++                                         MAX_MEM_SPOOL);
++        if (status != OK) {
++            goto cleanup;
++        }
++
++        /*
++         * The request body is streamed by default, using either C-L or
++         * chunked T-E, like this:
++         *
++         *   The whole body (including no body) was received on prefetch, i.e.
++         *   the input brigade ends with EOS => C-L = input_bytes.
++         *
++         *   C-L is known and reliable, i.e. only protocol filters in the input
++         *   chain thus none should change the body => use C-L from client.
++         *
++         *   The administrator has not "proxy-sendcl" which prevents T-E => use
++         *   T-E and chunks.
++         *
++         *   Otherwise we need to determine and set a content-length, so spool
++         *   the entire request body to memory/temporary file (MAX_MEM_SPOOL),
++         *   such that we finally know its length => C-L = input_bytes.
++         */
++        if (!APR_BRIGADE_EMPTY(input_brigade)
++                && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
++            /* The whole thing fit, so our decision is trivial, use the input
++             * bytes for the Content-Length. If we expected no body, and read
++             * no body, do not set the Content-Length.
++             */
++            if (old_cl || old_te || input_bytes) {
++                apr_table_setn(r->headers_in, "Content-Length",
++                               apr_off_t_toa(p, input_bytes));
++                if (old_te) {
++                    apr_table_unset(r->headers_in, "Transfer-Encoding");
++                }
++            }
++        }
++        else if (old_cl && r->input_filters == r->proto_input_filters) {
++            /* Streaming is possible by preserving the existing C-L */
++        }
++        else if (!apr_table_get(r->subprocess_env, "proxy-sendcl")) {
++            /* Streaming is possible using T-E: chunked */
++        }
++        else {
++            /* No streaming, C-L is the only option so spool to memory/file */
++            apr_bucket_brigade *tmp_bb;
++            apr_off_t remaining_bytes = 0;
++
++            AP_DEBUG_ASSERT(MAX_MEM_SPOOL >= input_bytes);
++            tmp_bb = apr_brigade_create(p, r->connection->bucket_alloc);
++            status = ap_proxy_spool_input(r, backend, tmp_bb, &remaining_bytes,
++                                          MAX_MEM_SPOOL - input_bytes);
++            if (status != OK) {
++                goto cleanup;
++            }
++
++            APR_BRIGADE_CONCAT(input_brigade, tmp_bb);
++            input_bytes += remaining_bytes;
++
++            apr_table_setn(r->headers_in, "Content-Length",
++                           apr_off_t_toa(p, input_bytes));
++            if (old_te) {
++                apr_table_unset(r->headers_in, "Transfer-Encoding");
++            }
++        }
++    }
++
+     /* This scheme handler does not reuse connections by default, to
+      * avoid tying up a fastcgi that isn't expecting to work on
+      * parallel requests.  But if the user went out of their way to
+@@ -1074,7 +1193,7 @@ static int proxy_fcgi_handler(request_rec *r, proxy_worker *worker,
+ 
+     /* Step Three: Process the Request */
+     status = fcgi_do_request(p, r, backend, origin, dconf, uri, url,
+-                             server_portstr);
++                             server_portstr, input_brigade);
+ 
+ cleanup:
+     ap_proxy_release_connection(FCGI_SCHEME, backend, r->server);
+diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
+index df10997..7f67f26 100644
+--- a/modules/proxy/mod_proxy_http.c
++++ b/modules/proxy/mod_proxy_http.c
+@@ -266,50 +266,6 @@ typedef struct {
+                  prefetch_nonblocking:1;
+ } proxy_http_req_t;
+ 
+-/* Read what's in the client pipe. If nonblocking is set and read is EAGAIN,
+- * pass a FLUSH bucket to the backend and read again in blocking mode.
+- */
+-static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb,
+-                               int nonblocking)
+-{
+-    request_rec *r = req->r;
+-    proxy_conn_rec *p_conn = req->backend;
+-    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
+-    apr_read_type_e block = nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
+-    apr_status_t status;
+-    int rv;
+-
+-    for (;;) {
+-        status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
+-                                block, HUGE_STRING_LEN);
+-        if (block == APR_BLOCK_READ
+-                || (!APR_STATUS_IS_EAGAIN(status)
+-                    && (status != APR_SUCCESS || !APR_BRIGADE_EMPTY(bb)))) {
+-            break;
+-        }
+-
+-        /* Flush and retry (blocking) */
+-        apr_brigade_cleanup(bb);
+-        rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin, bb, 1);
+-        if (rv != OK) {
+-            return rv;
+-        }
+-        block = APR_BLOCK_READ;
+-    }
+-
+-    if (status != APR_SUCCESS) {
+-        conn_rec *c = r->connection;
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608)
+-                      "read request body failed to %pI (%s)"
+-                      " from %s (%s)", p_conn->addr,
+-                      p_conn->hostname ? p_conn->hostname: "",
+-                      c->client_ip, c->remote_host ? c->remote_host: "");
+-        return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
+-    }
+-
+-    return OK;
+-}
+-
+ static int stream_reqbody(proxy_http_req_t *req)
+ {
+     request_rec *r = req->r;
+@@ -328,7 +284,8 @@ static int stream_reqbody(proxy_http_req_t *req)
+     do {
+         if (APR_BRIGADE_EMPTY(input_brigade)
+                 && APR_BRIGADE_EMPTY(header_brigade)) {
+-            rv = stream_reqbody_read(req, input_brigade, 1);
++            rv = ap_proxy_read_input(r, p_conn, input_brigade,
++                                     HUGE_STRING_LEN);
+             if (rv != OK) {
+                 return rv;
+             }
+@@ -409,7 +366,7 @@ static int stream_reqbody(proxy_http_req_t *req)
+          */
+         APR_BRIGADE_PREPEND(input_brigade, header_brigade);
+ 
+-        /* Flush here on EOS because we won't stream_reqbody_read() again */
++        /* Flush here on EOS because we won't ap_proxy_read_input() again. */
+         rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin,
+                                    input_brigade, seen_eos);
+         if (rv != OK) {
+@@ -427,137 +384,6 @@ static int stream_reqbody(proxy_http_req_t *req)
+     return OK;
+ }
+ 
+-static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
+-{
+-    apr_pool_t *p = req->p;
+-    request_rec *r = req->r;
+-    int seen_eos = 0, rv = OK;
+-    apr_status_t status = APR_SUCCESS;
+-    apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
+-    apr_bucket_brigade *input_brigade = req->input_brigade;
+-    apr_bucket_brigade *body_brigade;
+-    apr_bucket *e;
+-    apr_off_t bytes, fsize = 0;
+-    apr_file_t *tmpfile = NULL;
+-    apr_off_t limit;
+-
+-    body_brigade = apr_brigade_create(p, bucket_alloc);
+-    *bytes_spooled = 0;
+-
+-    limit = ap_get_limit_req_body(r);
+-
+-    do {
+-        if (APR_BRIGADE_EMPTY(input_brigade)) {
+-            rv = stream_reqbody_read(req, input_brigade, 0);
+-            if (rv != OK) {
+-                return rv;
+-            }
+-        }
+-
+-        /* If this brigade contains EOS, either stop or remove it. */
+-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
+-            seen_eos = 1;
+-        }
+-
+-        apr_brigade_length(input_brigade, 1, &bytes);
+-
+-        if (*bytes_spooled + bytes > MAX_MEM_SPOOL) {
+-            /*
+-             * LimitRequestBody does not affect Proxy requests (Should it?).
+-             * Let it take effect if we decide to store the body in a
+-             * temporary file on disk.
+-             */
+-            if (limit && (*bytes_spooled + bytes > limit)) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088)
+-                              "Request body is larger than the configured "
+-                              "limit of %" APR_OFF_T_FMT, limit);
+-                return HTTP_REQUEST_ENTITY_TOO_LARGE;
+-            }
+-            /* can't spool any more in memory; write latest brigade to disk */
+-            if (tmpfile == NULL) {
+-                const char *temp_dir;
+-                char *template;
+-
+-                status = apr_temp_dir_get(&temp_dir, p);
+-                if (status != APR_SUCCESS) {
+-                    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01089)
+-                                  "search for temporary directory failed");
+-                    return HTTP_INTERNAL_SERVER_ERROR;
+-                }
+-                apr_filepath_merge(&template, temp_dir,
+-                                   "modproxy.tmp.XXXXXX",
+-                                   APR_FILEPATH_NATIVE, p);
+-                status = apr_file_mktemp(&tmpfile, template, 0, p);
+-                if (status != APR_SUCCESS) {
+-                    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01090)
+-                                  "creation of temporary file in directory "
+-                                  "%s failed", temp_dir);
+-                    return HTTP_INTERNAL_SERVER_ERROR;
+-                }
+-            }
+-            for (e = APR_BRIGADE_FIRST(input_brigade);
+-                 e != APR_BRIGADE_SENTINEL(input_brigade);
+-                 e = APR_BUCKET_NEXT(e)) {
+-                const char *data;
+-                apr_size_t bytes_read, bytes_written;
+-
+-                apr_bucket_read(e, &data, &bytes_read, APR_BLOCK_READ);
+-                status = apr_file_write_full(tmpfile, data, bytes_read, &bytes_written);
+-                if (status != APR_SUCCESS) {
+-                    const char *tmpfile_name;
+-
+-                    if (apr_file_name_get(&tmpfile_name, tmpfile) != APR_SUCCESS) {
+-                        tmpfile_name = "(unknown)";
+-                    }
+-                    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01091)
+-                                  "write to temporary file %s failed",
+-                                  tmpfile_name);
+-                    return HTTP_INTERNAL_SERVER_ERROR;
+-                }
+-                AP_DEBUG_ASSERT(bytes_read == bytes_written);
+-                fsize += bytes_written;
+-            }
+-            apr_brigade_cleanup(input_brigade);
+-        }
+-        else {
+-
+-            /*
+-             * Save input_brigade in body_brigade. (At least) in the SSL case
+-             * input_brigade contains transient buckets whose data would get
+-             * overwritten during the next call of ap_get_brigade in the loop.
+-             * ap_save_brigade ensures these buckets to be set aside.
+-             * Calling ap_save_brigade with NULL as filter is OK, because
+-             * body_brigade already has been created and does not need to get
+-             * created by ap_save_brigade.
+-             */
+-            status = ap_save_brigade(NULL, &body_brigade, &input_brigade, p);
+-            if (status != APR_SUCCESS) {
+-                return HTTP_INTERNAL_SERVER_ERROR;
+-            }
+-
+-        }
+-
+-        *bytes_spooled += bytes;
+-    } while (!seen_eos);
+-
+-    APR_BRIGADE_CONCAT(input_brigade, body_brigade);
+-    if (tmpfile) {
+-        apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p);
+-    }
+-    if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
+-        e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
+-    }
+-    if (tmpfile) {
+-        /* We dropped metadata buckets when spooling to tmpfile,
+-         * terminate with EOS for stream_reqbody() to flush the
+-         * whole in one go.
+-         */
+-        e = apr_bucket_eos_create(bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
+-    }
+-    return OK;
+-}
+ 
+ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
+                                   apr_uri_t *uri, char *url)
+@@ -569,14 +395,12 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
+     apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
+     apr_bucket_brigade *header_brigade = req->header_brigade;
+     apr_bucket_brigade *input_brigade = req->input_brigade;
+-    apr_bucket_brigade *temp_brigade;
+     apr_bucket *e;
+-    char *buf;
+     apr_status_t status;
++    char *buf;
+     apr_off_t bytes_read = 0;
+     apr_off_t bytes;
+     int force10, rv;
+-    apr_read_type_e block;
+     conn_rec *origin = p_conn->connection;
+ 
+     if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) {
+@@ -641,69 +465,12 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
+         p_conn->close = 1;
+     }
+ 
+-    /* Prefetch MAX_MEM_SPOOL bytes
+-     *
+-     * This helps us avoid any election of C-L v.s. T-E
+-     * request bodies, since we are willing to keep in
+-     * memory this much data, in any case.  This gives
+-     * us an instant C-L election if the body is of some
+-     * reasonable size.
+-     */
+-    temp_brigade = apr_brigade_create(p, bucket_alloc);
+-    block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
+-
+-    /* Account for saved input, if any. */
+-    apr_brigade_length(input_brigade, 0, &bytes_read);
+-
+-    /* Ensure we don't hit a wall where we have a buffer too small
+-     * for ap_get_brigade's filters to fetch us another bucket,
+-     * surrender once we hit 80 bytes less than MAX_MEM_SPOOL
+-     * (an arbitrary value).
+-     */
+-    while (bytes_read < MAX_MEM_SPOOL - 80
+-           && (APR_BRIGADE_EMPTY(input_brigade)
+-               || !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)))) {
+-        status = ap_get_brigade(r->input_filters, temp_brigade,
+-                                AP_MODE_READBYTES, block,
+-                                MAX_MEM_SPOOL - bytes_read);
+-        /* ap_get_brigade may return success with an empty brigade
+-         * for a non-blocking read which would block
+-         */
+-        if (block == APR_NONBLOCK_READ
+-            && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade))
+-                || APR_STATUS_IS_EAGAIN(status))) {
+-            break;
+-        }
+-        if (status != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095)
+-                          "prefetch request body failed to %pI (%s)"
+-                          " from %s (%s)",
+-                          p_conn->addr, p_conn->hostname ? p_conn->hostname: "",
+-                          c->client_ip, c->remote_host ? c->remote_host: "");
+-            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
+-        }
+-
+-        apr_brigade_length(temp_brigade, 1, &bytes);
+-        bytes_read += bytes;
+-
+-        /*
+-         * Save temp_brigade in input_brigade. (At least) in the SSL case
+-         * temp_brigade contains transient buckets whose data would get
+-         * overwritten during the next call of ap_get_brigade in the loop.
+-         * ap_save_brigade ensures these buckets to be set aside.
+-         * Calling ap_save_brigade with NULL as filter is OK, because
+-         * input_brigade already has been created and does not need to get
+-         * created by ap_save_brigade.
+-         */
+-        status = ap_save_brigade(NULL, &input_brigade, &temp_brigade, p);
+-        if (status != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01096)
+-                          "processing prefetched request body failed"
+-                          " to %pI (%s) from %s (%s)",
+-                          p_conn->addr, p_conn->hostname ? p_conn->hostname: "",
+-                          c->client_ip, c->remote_host ? c->remote_host: "");
+-            return HTTP_INTERNAL_SERVER_ERROR;
+-        }
++    rv = ap_proxy_prefetch_input(r, req->backend, input_brigade,
++                                 req->prefetch_nonblocking ? APR_NONBLOCK_READ
++                                                           : APR_BLOCK_READ,
++                                 &bytes_read, MAX_MEM_SPOOL);
++    if (rv != OK) {
++        return rv;
+     }
+ 
+     /* Use chunked request body encoding or send a content-length body?
+@@ -772,7 +539,7 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
+             char *endstr;
+             status = apr_strtoff(&req->cl_val, req->old_cl_val, &endstr, 10);
+             if (status != APR_SUCCESS || *endstr || req->cl_val < 0) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01085)
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01085)
+                               "could not parse request Content-Length (%s)",
+                               req->old_cl_val);
+                 return HTTP_BAD_REQUEST;
+@@ -812,7 +579,8 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
+         /* If we have to spool the body, do it now, before connecting or
+          * reusing the backend connection.
+          */
+-        rv = spool_reqbody_cl(req, &bytes);
++        rv = ap_proxy_spool_input(r, p_conn, input_brigade,
++                                  &bytes, MAX_MEM_SPOOL);
+         if (rv != OK) {
+             return rv;
+         }
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index ab88d8f..973aa83 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -3866,6 +3866,268 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+     return OK;
+ }
+ 
++PROXY_DECLARE(int) ap_proxy_prefetch_input(request_rec *r,
++                                           proxy_conn_rec *backend,
++                                           apr_bucket_brigade *input_brigade,
++                                           apr_read_type_e block,
++                                           apr_off_t *bytes_read,
++                                           apr_off_t max_read)
++{
++    apr_pool_t *p = r->pool;
++    conn_rec *c = r->connection;
++    apr_bucket_brigade *temp_brigade;
++    apr_status_t status;
++    apr_off_t bytes;
++
++    *bytes_read = 0;
++    if (max_read < APR_BUCKET_BUFF_SIZE) {
++        max_read = APR_BUCKET_BUFF_SIZE;
++    }
++
++    /* Prefetch max_read bytes
++     *
++     * This helps us avoid any election of C-L v.s. T-E
++     * request bodies, since we are willing to keep in
++     * memory this much data, in any case.  This gives
++     * us an instant C-L election if the body is of some
++     * reasonable size.
++     */
++    temp_brigade = apr_brigade_create(p, input_brigade->bucket_alloc);
++
++    /* Account for saved input, if any. */
++    apr_brigade_length(input_brigade, 0, bytes_read);
++
++    /* Ensure we don't hit a wall where we have a buffer too small for
++     * ap_get_brigade's filters to fetch us another bucket, surrender
++     * once we hit 80 bytes (an arbitrary value) less than max_read.
++     */
++    while (*bytes_read < max_read - 80
++           && (APR_BRIGADE_EMPTY(input_brigade)
++               || !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)))) {
++        status = ap_get_brigade(r->input_filters, temp_brigade,
++                                AP_MODE_READBYTES, block,
++                                max_read - *bytes_read);
++        /* ap_get_brigade may return success with an empty brigade
++         * for a non-blocking read which would block
++         */
++        if (block == APR_NONBLOCK_READ
++                && ((status == APR_SUCCESS && APR_BRIGADE_EMPTY(temp_brigade))
++                    || APR_STATUS_IS_EAGAIN(status))) {
++            break;
++        }
++        if (status != APR_SUCCESS) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01095)
++                          "prefetch request body failed to %pI (%s)"
++                          " from %s (%s)", backend->addr,
++                          backend->hostname ? backend->hostname : "",
++                          c->client_ip, c->remote_host ? c->remote_host : "");
++            return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
++        }
++
++        apr_brigade_length(temp_brigade, 1, &bytes);
++        *bytes_read += bytes;
++
++        /*
++         * Save temp_brigade in input_brigade. (At least) in the SSL case
++         * temp_brigade contains transient buckets whose data would get
++         * overwritten during the next call of ap_get_brigade in the loop.
++         * ap_save_brigade ensures these buckets to be set aside.
++         * Calling ap_save_brigade with NULL as filter is OK, because
++         * input_brigade already has been created and does not need to get
++         * created by ap_save_brigade.
++         */
++        status = ap_save_brigade(NULL, &input_brigade, &temp_brigade, p);
++        if (status != APR_SUCCESS) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01096)
++                          "processing prefetched request body failed"
++                          " to %pI (%s) from %s (%s)", backend->addr,
++                          backend->hostname ? backend->hostname : "",
++                          c->client_ip, c->remote_host ? c->remote_host : "");
++            return HTTP_INTERNAL_SERVER_ERROR;
++        }
++    }
++
++    return OK;
++}
++
++PROXY_DECLARE(int) ap_proxy_read_input(request_rec *r,
++                                       proxy_conn_rec *backend,
++                                       apr_bucket_brigade *bb,
++                                       apr_off_t max_read)
++{
++    apr_bucket_alloc_t *bucket_alloc = bb->bucket_alloc;
++    apr_read_type_e block = (backend->connection) ? APR_NONBLOCK_READ
++                                                  : APR_BLOCK_READ;
++    apr_status_t status;
++    int rv;
++
++    for (;;) {
++        apr_brigade_cleanup(bb);
++        status = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
++                                block, max_read);
++        if (block == APR_BLOCK_READ
++                || (!(status == APR_SUCCESS && APR_BRIGADE_EMPTY(bb))
++                    && !APR_STATUS_IS_EAGAIN(status))) {
++            break;
++        }
++
++        /* Flush and retry (blocking) */
++        apr_brigade_cleanup(bb);
++        rv = ap_proxy_pass_brigade(bucket_alloc, r, backend,
++                                   backend->connection, bb, 1);
++        if (rv != OK) {
++            return rv;
++        }
++        block = APR_BLOCK_READ;
++    }
++
++    if (status != APR_SUCCESS) {
++        conn_rec *c = r->connection;
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(02608)
++                      "read request body failed to %pI (%s)"
++                      " from %s (%s)", backend->addr,
++                      backend->hostname ? backend->hostname : "",
++                      c->client_ip, c->remote_host ? c->remote_host : "");
++        return ap_map_http_request_error(status, HTTP_BAD_REQUEST);
++    }
++
++    return OK;
++}
++
++PROXY_DECLARE(int) ap_proxy_spool_input(request_rec *r,
++                                        proxy_conn_rec *backend,
++                                        apr_bucket_brigade *input_brigade,
++                                        apr_off_t *bytes_spooled,
++                                        apr_off_t max_mem_spool)
++{
++    apr_pool_t *p = r->pool;
++    int seen_eos = 0, rv = OK;
++    apr_status_t status = APR_SUCCESS;
++    apr_bucket_alloc_t *bucket_alloc = input_brigade->bucket_alloc;
++    apr_bucket_brigade *body_brigade;
++    apr_bucket *e;
++    apr_off_t bytes, fsize = 0;
++    apr_file_t *tmpfile = NULL;
++    apr_off_t limit;
++
++    *bytes_spooled = 0;
++    body_brigade = apr_brigade_create(p, bucket_alloc);
++
++    limit = ap_get_limit_req_body(r);
++
++    do {
++        if (APR_BRIGADE_EMPTY(input_brigade)) {
++            rv = ap_proxy_read_input(r, backend, input_brigade,
++                                     HUGE_STRING_LEN);
++            if (rv != OK) {
++                return rv;
++            }
++        }
++
++        /* If this brigade contains EOS, either stop or remove it. */
++        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
++            seen_eos = 1;
++        }
++
++        apr_brigade_length(input_brigade, 1, &bytes);
++
++        if (*bytes_spooled + bytes > max_mem_spool) {
++            /*
++             * LimitRequestBody does not affect Proxy requests (Should it?).
++             * Let it take effect if we decide to store the body in a
++             * temporary file on disk.
++             */
++            if (limit && (*bytes_spooled + bytes > limit)) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088)
++                              "Request body is larger than the configured "
++                              "limit of %" APR_OFF_T_FMT, limit);
++                return HTTP_REQUEST_ENTITY_TOO_LARGE;
++            }
++            /* can't spool any more in memory; write latest brigade to disk */
++            if (tmpfile == NULL) {
++                const char *temp_dir;
++                char *template;
++
++                status = apr_temp_dir_get(&temp_dir, p);
++                if (status != APR_SUCCESS) {
++                    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01089)
++                                  "search for temporary directory failed");
++                    return HTTP_INTERNAL_SERVER_ERROR;
++                }
++                apr_filepath_merge(&template, temp_dir,
++                                   "modproxy.tmp.XXXXXX",
++                                   APR_FILEPATH_NATIVE, p);
++                status = apr_file_mktemp(&tmpfile, template, 0, p);
++                if (status != APR_SUCCESS) {
++                    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01090)
++                                  "creation of temporary file in directory "
++                                  "%s failed", temp_dir);
++                    return HTTP_INTERNAL_SERVER_ERROR;
++                }
++            }
++            for (e = APR_BRIGADE_FIRST(input_brigade);
++                 e != APR_BRIGADE_SENTINEL(input_brigade);
++                 e = APR_BUCKET_NEXT(e)) {
++                const char *data;
++                apr_size_t bytes_read, bytes_written;
++
++                apr_bucket_read(e, &data, &bytes_read, APR_BLOCK_READ);
++                status = apr_file_write_full(tmpfile, data, bytes_read, &bytes_written);
++                if (status != APR_SUCCESS) {
++                    const char *tmpfile_name;
++
++                    if (apr_file_name_get(&tmpfile_name, tmpfile) != APR_SUCCESS) {
++                        tmpfile_name = "(unknown)";
++                    }
++                    ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(01091)
++                                  "write to temporary file %s failed",
++                                  tmpfile_name);
++                    return HTTP_INTERNAL_SERVER_ERROR;
++                }
++                AP_DEBUG_ASSERT(bytes_read == bytes_written);
++                fsize += bytes_written;
++            }
++            apr_brigade_cleanup(input_brigade);
++        }
++        else {
++
++            /*
++             * Save input_brigade in body_brigade. (At least) in the SSL case
++             * input_brigade contains transient buckets whose data would get
++             * overwritten during the next call of ap_get_brigade in the loop.
++             * ap_save_brigade ensures these buckets to be set aside.
++             * Calling ap_save_brigade with NULL as filter is OK, because
++             * body_brigade already has been created and does not need to get
++             * created by ap_save_brigade.
++             */
++            status = ap_save_brigade(NULL, &body_brigade, &input_brigade, p);
++            if (status != APR_SUCCESS) {
++                return HTTP_INTERNAL_SERVER_ERROR;
++            }
++
++        }
++
++        *bytes_spooled += bytes;
++    } while (!seen_eos);
++
++    APR_BRIGADE_CONCAT(input_brigade, body_brigade);
++    if (tmpfile) {
++        apr_brigade_insert_file(input_brigade, tmpfile, 0, fsize, p);
++    }
++    if (apr_table_get(r->subprocess_env, "proxy-sendextracrlf")) {
++        e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
++        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
++    }
++    if (tmpfile) {
++        /* We dropped metadata buckets when spooling to tmpfile,
++         * terminate with EOS to allow for flushing in a one go.
++         */
++        e = apr_bucket_eos_create(bucket_alloc);
++        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
++    }
++    return OK;
++}
++
+ PROXY_DECLARE(int) ap_proxy_pass_brigade(apr_bucket_alloc_t *bucket_alloc,
+                                          request_rec *r, proxy_conn_rec *p_conn,
+                                          conn_rec *origin, apr_bucket_brigade *bb,

SOURCES/httpd-2.4.37-r1919325.patch

@@ -0,0 +1,217 @@
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 114b126..a25c7ae 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -2343,9 +2343,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c)
+  * of an earlier expansion to include expansion specifiers that
+  * are interpreted by a later expansion, producing results that
+  * were not intended by the administrator.
++ *
++ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark
++ * is found respectively in a literal or in a lookup/expansion (whether
++ * it's the first or last qmark depends on [QSL]). Should be initialized
++ * to -1 and remains so if no qmark is found.
+  */
+-static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
++static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
++                       int *unsafe_qmark)
+ {
++#define EXPAND_SPECIALS "\\$%"
+     result_list *result, *current;
+     result_list sresult[SMALL_EXPANSION];
+     unsigned spc = 0;
+@@ -2353,8 +2360,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+     char *p, *c;
+     apr_pool_t *pool = ctx->r->pool;
+ 
+-    span = strcspn(input, "\\$%");
+     inputlen = strlen(input);
++    if (!unsafe_qmark) {
++        span = strcspn(input, EXPAND_SPECIALS);
++    }
++    else {
++        span = strcspn(input, EXPAND_SPECIALS "?");
++        if (input[span] == '?') {
++            /* this qmark is not from an expansion thus safe */
++            *unsafe_qmark = 0;
++
++            /* keep tracking only if interested in the last qmark */
++            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
++                do {
++                    span++;
++                    span += strcspn(input + span, EXPAND_SPECIALS "?");
++                } while (input[span] == '?');
++            }
++            else {
++                unsafe_qmark = NULL;
++                span += strcspn(input + span, EXPAND_SPECIALS);
++            }
++        }
++    }
+ 
+     /* fast exit */
+     if (inputlen == span) {
+@@ -2372,6 +2400,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+ 
+     /* loop for specials */
+     do {
++        int expanded = 0;
++
+         /* prepare next entry */
+         if (current->len) {
+             current->next = (spc < SMALL_EXPANSION)
+@@ -2417,6 +2447,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                 current->len = span;
+                 current->string = p;
+                 outlen += span;
++
++                expanded = 1;
+                 p = endp + 1;
+             }
+ 
+@@ -2456,19 +2488,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     }
+ 
+                     /* reuse of key variable as result */
+-                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));
+-
++                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL));
+                     if (!key && dflt && *dflt) {
+-                        key = do_expand(dflt, ctx, entry);
++                        key = do_expand(dflt, ctx, entry, NULL);
+                     }
+-
+-                    if (key) {
++                    if (key && *key) {
+                         span = strlen(key);
+                         current->len = span;
+                         current->string = key;
+                         outlen += span;
+                     }
+ 
++                    expanded = 1;
+                     p = endp + 1;
+                 }
+             }
+@@ -2498,8 +2529,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+                     current->len = span;
+                     current->string = bri->source + bri->regmatch[n].rm_so;
+                 }
+-
+                 outlen += span;
++
++                expanded = 1;
+             }
+ 
+             p += 2;
+@@ -2512,8 +2544,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
+             ++outlen;
+         }
+ 
++        if (unsafe_qmark && expanded && current->len
++            && memchr(current->string, '?', current->len)) {
++            /* this qmark is from an expansion thus unsafe */
++            *unsafe_qmark = 1;
++
++            /* keep tracking only if interested in the last qmark */
++            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
++                unsafe_qmark = NULL;
++            }
++        }
++
+         /* check the remainder */
+-        if (*p && (span = strcspn(p, "\\$%")) > 0) {
++        if (!unsafe_qmark) {
++            span = strcspn(p, EXPAND_SPECIALS);
++        }
++        else {
++            span = strcspn(p, EXPAND_SPECIALS "?");
++            if (p[span] == '?') {
++                /* this qmark is not from an expansion thus safe */
++                *unsafe_qmark = 0;
++
++                /* keep tracking only if interested in the last qmark */
++                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
++                    do {
++                        span++;
++                        span += strcspn(p + span, EXPAND_SPECIALS "?");
++                    } while (p[span] == '?');
++                }
++                else {
++                    unsafe_qmark = NULL;
++                    span += strcspn(p + span, EXPAND_SPECIALS);
++                }
++            }
++        }
++        if (span > 0) {
+             if (current->len) {
+                 current->next = (spc < SMALL_EXPANSION)
+                                 ? &(sresult[spc++])
+@@ -2558,7 +2623,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx)
+     char *name, *val;
+ 
+     while (env) {
+-        name = do_expand(env->data, ctx, NULL);
++        name = do_expand(env->data, ctx, NULL, NULL);
+         if (*name == '!') {
+             name++;
+             apr_table_unset(ctx->r->subprocess_env, name);
+@@ -2685,7 +2750,7 @@ static void add_cookie(request_rec *r, char *s)
+ static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx)
+ {
+     while (cookie) {
+-        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL));
++        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL));
+         cookie = cookie->next;
+     }
+ 
+@@ -3964,7 +4029,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx)
+     int basis;
+ 
+     if (p->ptype != CONDPAT_AP_EXPR)
+-        input = do_expand(p->input, ctx, NULL);
++        input = do_expand(p->input, ctx, NULL, NULL);
+ 
+     switch (p->ptype) {
+     case CONDPAT_FILE_EXISTS:
+@@ -4128,7 +4193,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+     char *expanded;
+ 
+     if (p->forced_mimetype) {
+-        expanded = do_expand(p->forced_mimetype, ctx, p);
++        expanded = do_expand(p->forced_mimetype, ctx, p, NULL);
+ 
+         if (*expanded) {
+             ap_str_tolower(expanded);
+@@ -4142,7 +4207,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+     }
+ 
+     if (p->forced_handler) {
+-        expanded = do_expand(p->forced_handler, ctx, p);
++        expanded = do_expand(p->forced_handler, ctx, p, NULL);
+ 
+         if (*expanded) {
+             ap_str_tolower(expanded);
+@@ -4279,12 +4344,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+ 
+     /* expand the result */
+     if (!(p->flags & RULEFLAG_NOSUB)) {
+-        newuri = do_expand(p->output, ctx, p);
++        int unsafe_qmark = -1;
++
++        if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) {
++            newuri = do_expand(p->output, ctx, p, NULL);
++        }
++        else {
++            newuri = do_expand(p->output, ctx, p, &unsafe_qmark);
++        }
+         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+                     newuri));
+-        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
+-            ap_strcasestr(r->unparsed_uri, "%3f") &&
+-            ap_strchr_c(newuri, '?')) {
++
++        if (unsafe_qmark > 0) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
+                     "Unsafe URL with %%3f URL rewritten without "
+                     "UnsafeAllow3F");

SOURCES/httpd-2.4.57-r1884505+.patch

@@ -0,0 +1,39 @@
+# ./pullrev.sh 1884505 1915625
+http://svn.apache.org/viewvc?view=revision&revision=1884505
+http://svn.apache.org/viewvc?view=revision&revision=1915625
+
+--- httpd-2.4.57/modules/filters/mod_xml2enc.c
++++ httpd-2.4.57/modules/filters/mod_xml2enc.c
+@@ -329,7 +329,7 @@
+     apr_bucket* bstart;
+     apr_size_t insz = 0;
+     int pending_meta = 0;
+-    char *ctype;
++    char *mtype;
+     char *p;
+ 
+     if (!ctx || !f->r->content_type) {
+@@ -338,13 +338,17 @@
+         return ap_pass_brigade(f->next, bb) ;
+     }
+ 
+-    ctype = apr_pstrdup(f->r->pool, f->r->content_type);
+-    for (p = ctype; *p; ++p)
+-        if (isupper(*p))
+-            *p = tolower(*p);
++    /* Extract the media type, ignoring parameters in content-type. */
++    mtype = apr_pstrdup(f->r->pool, f->r->content_type);
++    if ((p = ap_strchr(mtype, ';')) != NULL) *p = '\0';
++    ap_str_tolower(mtype);
+ 
+-    /* only act if starts-with "text/" or contains "xml" */
+-    if (strncmp(ctype, "text/", 5) && !strstr(ctype, "xml"))  {
++    /* Accept text/ types, plus any XML media type per RFC 7303. */
++    if (!(strncmp(mtype, "text/", 5) == 0
++          || strcmp(mtype, "application/xml") == 0
++          || (strlen(mtype) > 7 /* minimum 'a/b+xml' length */
++              && (p = strstr(mtype, "+xml")) != NULL
++              && strlen(p) == 4 /* ensures +xml is a suffix */))) {
+         ap_remove_output_filter(f);
+         return ap_pass_brigade(f->next, bb) ;
+     }

SOURCES/httpd-init.service

@@ -8,5 +8,6 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key
 [Service]
 Type=oneshot
 RemainAfterExit=no
+PrivateTmp=true
 
 ExecStart=/usr/libexec/httpd-ssl-gencerts

SOURCES/httpd-ssl-gencerts

@@ -33,6 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
+     --dhparams-file       /tmp/dhparams.pem                        \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN

SPECS/httpd.spec

@@ -3,7 +3,7 @@
 %define suexec_caller apache
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
-%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
+%define vstring %(source /etc/os-release; echo ${NAME})
 %if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
 %else
@@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.37
-Release: 54%{?dist}
+Release: 65%{?dist}.2
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source2: httpd.logrotate
@@ -165,6 +165,14 @@ Patch89: httpd-2.4.37-r1862410.patch
 Patch90: httpd-2.4.37-hcheck-mem-issues.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2017543
 Patch91: httpd-2.4.37-add-SNI-support.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2159603
+Patch92: httpd-2.4.37-mod_status-duplicate-key.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2221083
+Patch93: httpd-2.4.37-r1885607.patch
+# https://issues.redhat.com/browse/RHEL-14321
+Patch94: httpd-2.4.57-r1884505+.patch
+# https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
+Patch95: httpd-2.4.37-r1919325.patch
 
 # Security fixes
 Patch200: httpd-2.4.37-r1851471.patch
@@ -240,7 +248,35 @@ Patch232: httpd-2.4.37-CVE-2022-31813.patch
 Patch233: httpd-2.4.37-CVE-2022-29404.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2094997
 Patch234: httpd-2.4.37-CVE-2022-26377.patch
-
+# https://bugzilla.redhat.com/show_bug.cgi?id=2161773
+Patch235: httpd-2.4.37-CVE-2022-37436.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2161774
+Patch236: httpd-2.4.37-CVE-2006-20001.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2161777
+Patch237: httpd-2.4.37-CVE-2022-36760.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2176209
+Patch238: httpd-2.4.37-CVE-2023-25690.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2176211
+Patch239: httpd-2.4.37-CVE-2023-27522.patch
+# https://issues.redhat.com/browse/RHEL-14448
+Patch240: httpd-2.4.37-CVE-2023-31122.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2273491
+Patch241: httpd-2.4.37-CVE-2023-38709.patch
+# CVE-2024-38474 and CVE-2024-38475 fixed in one patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295013
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295014
+Patch242: httpd-2.4.37-CVE-2024-38474+.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295012
+Patch243: httpd-2.4.37-CVE-2024-38473.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295016
+Patch244: httpd-2.4.37-CVE-2024-38477.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295022
+Patch245: httpd-2.4.37-CVE-2024-39573.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295015
+Patch246: httpd-2.4.37-CVE-2024-38476.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2297362
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295761
+Patch247: httpd-2.4.37-CVE-2024-39884+.patch
 
 License: ASL 2.0
 Group: System Environment/Daemons
@@ -322,7 +358,7 @@ Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.2.0, /usr/bin/hostname
+Requires: sscg >= 3.0.0-7, /usr/bin/hostname
 Obsoletes: stronghold-mod_ssl
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4
@@ -422,6 +458,9 @@ interface for storing and accessing per-user session data.
 %patch89 -p1 -b .r1862410
 %patch90 -p1 -b .hcheck-mem-issues
 %patch91 -p1 -b .SNI
+%patch92 -p1 -b .mod_status-dupl
+%patch93 -p1 -b .r1885607
+%patch94 -p1 -b .r1884505+
 
 %patch200 -p1 -b .r1851471
 %patch201 -p1 -b .CVE-2019-0211
@@ -458,6 +497,22 @@ interface for storing and accessing per-user session data.
 %patch232 -p1 -b .CVE-2022-31813
 %patch233 -p1 -b .CVE-2022-29404
 %patch234 -p1 -b .CVE-2022-26377
+%patch235 -p1 -b .CVE-2022-37436
+%patch236 -p1 -b .CVE-2006-20001
+%patch237 -p1 -b .CVE-2022-36760
+%patch238 -p1 -b .CVE-2023-25690
+%patch239 -p1 -b .CVE-2023-27522
+%patch240 -p1 -b .CVE-2023-31122
+%patch241 -p1 -b .CVE-2023-38709
+%patch242 -p1 -b .CVE-2024-38474+
+%patch243 -p1 -b .CVE-2024-38473
+%patch244 -p1 -b .CVE-2024-38477
+%patch245 -p1 -b .CVE-2024-39573
+
+# CVE-2024-38474 regression fix
+%patch95 -p1 -b .r1919325
+%patch246 -p1 -b .CVE-2024-38476
+%patch247 -p1 -b .CVE-2024-39884+
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -963,6 +1018,78 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Aug 06 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.2
+- Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
+  applications whose response headers are malicious or exploitable (CVE-2024-38476)
+- Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix
+
+* Thu Jul 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.1
+- Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
+  in mod_rewrite (CVE-2024-38474)
+- Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
+  mod_proxy (CVE-2024-38473)
+- Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
+  in mod_rewrite (CVE-2024-38475)
+- Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
+  in mod_proxy (CVE-2024-38477)
+- Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
+  in mod_rewrite (CVE-2024-39573)
+
+* Wed Jun 12 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65
+- Resolves: RHEL-31857 - httpd:2.4/httpd: HTTP response
+  splitting (CVE-2023-38709)
+
+* Fri Feb 16 2024 Joe Orton <jorton@redhat.com> - 2.4.37-64
+- Resolves: RHEL-14448 - httpd: mod_macro: out-of-bounds read
+  vulnerability (CVE-2023-31122)
+
+* Wed Feb 14 2024 Joe Orton <jorton@redhat.com> - 2.4.37-63
+- mod_xml2enc: fix media type handling
+  Resolves: RHEL-14321
+
+* Thu Aug 17 2023 Johnny Hughes <jhughes@redhat.com> - 2.4.37-62
+- change for CentOS Stream Branding
+
+* Thu Jul 27 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-62
+- Resolves: #2221083 - Apache Bug 57087: mod_proxy_fcgi doesn't send cgi 
+  CONTENT_LENGTH variable when the client request used Transfer-Encoding:chunked
+
+* Thu Jul 20 2023 Tomas Korbar <tkorbar@redhat.com> - 2.4.37-61
+- Fix issue found by covscan
+- Related: #2159603
+
+* Mon Jul 17 2023 Tomas Korbar <tkorbar@redhat.com> - 2.4.37-60
+- Another rebuild because of mistake in workflow
+- Related: #2159603
+
+* Mon Jul 17 2023 Tomas Korbar <tkorbar@redhat.com> - 2.4.37-59
+- Rebuild because of mistake in workflow
+- Related: #2159603
+
+* Mon Jul 17 2023 Tomas Korbar <tkorbar@redhat.com> - 2.4.37-58
+- Resolves: #2159603 - mod_status lists BusyWorkers IdleWorkers keys twice
+
+* Thu May 25 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-57
+- Resolves: #2176723 - CVE-2023-27522 httpd:2.4/httpd: mod_proxy_uwsgi HTTP
+  response splitting
+
+* Thu Apr 27 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56.5
+- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690
+
+* Sat Mar 18 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56.4
+- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
+  with mod_rewrite and mod_proxy
+
+* Tue Jan 31 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56
+- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
+  of zero byte
+- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
+- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
+  smuggling
+
+* Thu Jan 26 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-55
+- Resolves: #2155961 - prevent sscg creating /dhparams.pem
+
 * Thu Dec 08 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-54
 - Resolves: #2095650 - Dependency from mod_http2 on httpd broken