- CVE-2026-63718: mod_proxy_uwsgi: drop hop-by-hop headers from the backend response - CVE-2026-73636: mod_auth_digest: accept a one-time nonce only once, also when the client entry was garbage collected - CVE-2026-73637: mod_auth_digest: don't use a client entry outside the client lock - CVE-2026-48005: mod_auth_digest: track the nonce-count per nonce and record it only for a fully verified request - mod_auth_digest: configs using "AuthDigestQop none" or the "authdigest-opaque" Mutex type no longer start ("AuthDigestQop none" in .htaccess: 500; the shipped manual still documents it); RFC 2069 clients (no qop) are refused; with AuthDigestNcCheck On or AuthDigestNonceLifetime 0, 503 if no client entry fits in shared memory; log ids AH01767, AH01771, AH01772, AH01792 and AH01793 are removed - mod_auth_digest: with AuthDigestNcCheck On, a request that is authenticated twice (e.g. a DirectoryIndex file in its own section) is refused with 401 - mod_auth_digest: after a reload (also the logrotate one) or a SIGHUP restart a captured request can be accepted once more under AuthDigestNonceLifetime 0 or AuthDigestNcCheck; only stopping httpd (systemctl restart) invalidates it (fixed upstream only in trunk f4c4160fbf, not in 2.4.69) - CVE-2026-63686: mod_xml2enc: avoid a NULL pointer dereference when a charset conversion fails part way - CVE-2026-63045: mod_proxy_ftp: reject a PASV reply whose address differs from the control connection peer - CVE-2026-42528: mod_dav: limit the number of shared locks on a resource - CVE-2026-93546: mod_dav_fs: cap the property database namespace table at 2048 entries - CVE-2026-58415: mod_dav_fs: deny access to the .DAV state directory for all methods, including GET - CVE-2026-59797: mod_ssl: don't allow file() and filesize() in SSLRequire from .htaccess files - CVE-2026-79768: mod_userdir: reject "." as a user name