- CVE-2026-42356: do not run the target of a CGI internal redirect with the handler derived from the CGI request's trusted content type - CVE-2026-63686: fix mod_xml2enc NULL pointer dereference when a charset conversion partially succeeds and then fails - CVE-2026-63718: fix mod_proxy_uwsgi response smuggling via backend Transfer-Encoding by dropping hop-by-hop response headers - CVE-2026-73636: fix mod_auth_digest one-time nonce replay - CVE-2026-73637: fix mod_auth_digest use-after-free of shared client entries on concurrent requests - CVE-2026-48005: fix mod_auth_digest forced re-authentication via forged Authorization headers with AuthDigestNcCheck - mod_auth_digest: configs using "AuthDigestQop none" or the "authdigest-opaque" Mutex type no longer start (the shipped manual still documents "AuthDigestQop none"); RFC 2069 clients (no qop) are refused; with AuthDigestNcCheck On or AuthDigestNonceLifetime 0, 503 if no client entry fits in shared memory; log ids AH01767, AH01771, AH01772, AH01792 and AH01793 are removed - mod_auth_digest: with AuthDigestNcCheck On, a request that is authenticated twice (e.g. a DirectoryIndex file in its own section) is refused with 401 - mod_auth_digest: after a reload (also the logrotate one) or a SIGHUP restart a captured request can be accepted once more under AuthDigestNonceLifetime 0 or AuthDigestNcCheck; only stopping httpd (systemctl restart) invalidates it (fixed upstream only in trunk f4c4160fbf, not in 2.4.69)