[BKPepe]

📦 Package Details

Maintainer: @heil

Description:
Backport of the update to 2.4.71 from master (4fabb58, #31260). It fixes 3 CVEs, the most serious being CVE-2026-119618 (critical), heap corruption and possible RCE in mod_http2. All CVEs are listed in the commit message.

net/apache is now the same as in master.

---

🧪 Run Testing Details

• OpenWrt Version: openwrt-25.12 SDK (25.12-SNAPSHOT)
• OpenWrt Target/Subtarget: armsr/armv8 (aarch64_generic)
• OpenWrt Device: none, all 17 apache packages were built in the openwrt-25.12 SDK and passed the generic tests in the openwrt/rootfs:aarch64_generic-openwrt-25.12 container. apache2 2.4.71 started there with mod_http2, mod_md, mod_ssl and mod_vhost_alias loaded and answered HTTP/1.1 and h2c requests with 200.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

• It can be applied using git am
• It has been refreshed to avoid offsets, fuzzes, etc., using

  make package/<your-package>/refresh V=s

• It is structured in a way that it is potentially upstreamable
  _{(e.g., subject line, commit description, etc.)
  We must try to upstream patches to reduce maintenance burden.}