Topic: Apache httpd 2.4.68 GA Available :: Update

[Steffen]

Apache httpd 2.4.68 is released as GA.

27 August 2026 Update, see below

ASF and Apachelounge changes : https://www.apachelounge.com/Changelog-2.4.html

Lot of security fixes. See the important security vulnerabilities fixed in 2.4.xx, https://httpd.apache.org/security/vulnerabilities_24.html .

Documentation: http://httpd.apache.org/docs/2.4/

Build with dependencies:

- openssl 3.6.4
- nghttp2 1.70.0
- jansson 2.15.1
- curl 8.21.0
- apr 1.7.6
- apr-util 1.6.5
- apr-iconv 1.2.2
- zlib 1.3.2
- zstd 1.5.7
- brotli 1.2.0
- pcre2 10.47
- libxml2 2.15.3
- lua 5.5.1
- expat 2.8.3
- nghttp3 1.18.0
- ngtcp2 1.25.0

Enjoy

[admin]

There are scanner reports that the downloaded file contains viruses, not all scanners.

Scanners like defender on Windows reports that all is fine.

[axel.kam]

[BeWog]

Hello

I had already pointed out some differences here : https://www.apachelounge.com/viewtopic.php?p=44157#44157
and there still here.

I would really appreciate it if you could replace all occurrences of error_log to error.log
and access_log to access.log.

Thanks

[admin]

Thank you for your response and apologies that we missed your earlier request.

The AL filename format changed with the switch to CMake builds, since the source official template file docs/conf/httpd.conf.in contains the references to access_log and error_log which end up in httpd.conf.

For as long as I can remember those have been the default names when building with CMake or using the configure script under Linux. The only exception I know is Apache builds on Ubuntu, which defaults to access.log and error.log.

We are not changing it. It is part of the official Apache source code.

You have to change it manual.

[Steffen]

Updated with OpenSSL 3.6.3 and added zstd libraries.

See Changelog https://www.apachelounge.com/Changelog-2.4.html

[ltdeta]

changelog file
The last update has the wrong date. It shows “07” instead of “17”.

[Steffen]

Thanks!

Corrected.

[Steffen]

Updated httpd 2.4.68 dependencies (a lot, including OpenSSL).

Added nghttp3 and ngtcp2 libraries for Curl (added http3 support in Curl).

see https://www.apachelounge.com/Changelog-2.4.html

[BeWog]

Hello,

For your information, my antivirus (WithSecure) also flagged the latest version of C:\Apache24\bin\httpd.exe as suspicious.

Here is the translated message from WithSecure:

[admin]

False positive. Defender etc. no issue.

[tangent]

This repeated alert from WithSecure annoys me, and I rather agree this is a false positive.

Apache builds are created using the latest release of MSVC (VS18), and since this warning appears to have kicked off within the last two builds, to me it suggests it's something to do with MSVC compiler changes, particularly code optimisations. There is mention of such 'improvements' earlier this year here:- https://devblogs.microsoft.com/cppblog/c-performance-improvements-in-msvc-build-tools-v14-51

I considered uploading a copy of the latest HTTPD binary to WithSecure to go through their Sample Validation service, requesting they consider whitelisting this signature. Unfortunately, it seems WithSecure retired its old public "Submit a Sample" system at the end of December 2025, and their replacement is a Sample Validation service in WithSecure Elements Security Center, which requires an authenticated WithSecure account.

So instead I uploaded the binary to the TotalVirus site for consideration, since it claims to use WithSecure amongst various vendor scanners:- https://www.virustotal.com/gui/home/upload

For me it currently shows no issues with the httpd.exe binary out of the httpd-2.4.68-260827-Win64-VS18.zip archive, based on some 70 AV scanners including WithSecure. The result is available here:- https://www.virustotal.com/gui/file/e77b058389c9ed22ae9ddda16719780ac0c232d2bb1c4f417b8763fe241d96fe - the details tab confirms this is the Apache Lounge binary.

Interestingly though, if I upload the current HTTPD archive then 1 vendor (MaxSecure) moans about 14 files, assorted other exe's and dll's. Again, WithSecure had no issue with any files in the archive.

MaxSecure was the company @axel.kam previously mentioned in this post, but either way to me this result suggests WithSecure scans should be happy with the Apache Lounge binaries.