Topic: Apache httpd 2.4.68 GA Available :: Update

[Steffen]

Apache httpd 2.4.68 is released as GA.

27 August 2026 Update, see below

ASF and Apachelounge changes : https://www.apachelounge.com/Changelog-2.4.html

Lot of security fixes. See the important security vulnerabilities fixed in 2.4.xx, https://httpd.apache.org/security/vulnerabilities_24.html .

Documentation: http://httpd.apache.org/docs/2.4/

Build with dependencies:

- openssl 3.6.4
- nghttp2 1.70.0
- jansson 2.15.1
- curl 8.21.0
- apr 1.7.6
- apr-util 1.6.5
- apr-iconv 1.2.2
- zlib 1.3.2
- zstd 1.5.7
- brotli 1.2.0
- pcre2 10.47
- libxml2 2.15.3
- lua 5.5.1
- expat 2.8.3
- nghttp3 1.18.0
- ngtcp2 1.25.0

Enjoy

[admin]

There are scanner reports that the downloaded file contains viruses, not all scanners.

Scanners like defender on Windows reports that all is fine.

[axel.kam]

[BeWog]

Hello

I had already pointed out some differences here : https://www.apachelounge.com/viewtopic.php?p=44157#44157
and there still here.

I would really appreciate it if you could replace all occurrences of error_log to error.log
and access_log to access.log.

Thanks

[admin]

Thank you for your response and apologies that we missed your earlier request.

The AL filename format changed with the switch to CMake builds, since the source official template file docs/conf/httpd.conf.in contains the references to access_log and error_log which end up in httpd.conf.

For as long as I can remember those have been the default names when building with CMake or using the configure script under Linux. The only exception I know is Apache builds on Ubuntu, which defaults to access.log and error.log.

We are not changing it. It is part of the official Apache source code.

You have to change it manual.

[Steffen]

Updated with OpenSSL 3.6.3 and added zstd libraries.

See Changelog https://www.apachelounge.com/Changelog-2.4.html

[ltdeta]

changelog file
The last update has the wrong date. It shows “07” instead of “17”.

[Steffen]

Thanks!

Corrected.

[Steffen]

Updated httpd 2.4.68 dependencies (a lot, including OpenSSL).

Added nghttp3 and ngtcp2 libraries for Curl (added http3 support in Curl).

see https://www.apachelounge.com/Changelog-2.4.html

[BeWog]

Hello,

For your information, my antivirus (WithSecure) also flagged the latest version of C:\Apache24\bin\httpd.exe as suspicious.

Here is the translated message from WithSecure:

[admin]

False positive. Defender etc. no issue.