The currently selected mirror is http://newverhost.com/pub/. If you encounter a problem with this mirror, please select another mirror. If all mirrors are failing, there are backup mirrors (at the end of the mirrors list) that should be available.

You may also consult the complete list of mirrors.

The Apache HTTP Server Project is pleased to announce the release of Apache HTTP Server (httpd) version 2.2.22. This release represents fifteen years of innovation by the project, and is recommended over all previous releases!

For details see the Official Announcement and the CHANGES_2.2 or condensed CHANGES_2.2.22 lists

Add-in modules for Apache 2.0 are not compatible with Apache 2.2. If you are running third party add-in modules, you must obtain modules compiled or updated for Apache 2.2 from that third party, before you attempt to upgrade from these previous versions. Modules compiled for Apache 2.2 should continue to work for all 2.2.x releases.

The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the release of version 2.3.16-beta of the Apache HTTP Server ("Apache" and "httpd"). This version of Apache is our fifth beta release (and is considered as our first Release Candidate) to test new technology and features that are incompatible or too large for the stable 2.2.x branch. This beta release should not be presumed to be compatible with binaries built against any prior version, but is expected to accurately represent the API to be found in Apache HTTPD 2.4.0.

All subsequent releases will be beta releases as we move towards 2.4.0-GA.

For details see the Official Announcement and the CHANGES_2.3 and CHANGES_2.3.16 lists

Apache 2.0.64 is the legacy stable version of the 2.0 series, and is recommended over any previous 2.0 release. This release fixes a few potential security vulnerabilites.

For details see the Official Announcement and the CHANGES_2.0 and CHANGES_2.0.64 lists.

Apache 2.0 add-in modules are not compatible with Apache 2.2 modules. If you are running third party add-in modules, you will need to obtain modules compiled for or compatible with Apache 2.0 from that third party, before you attempt to use this specific release.

The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the release of version 2.3.6 of mod_fcgid, a FastCGI implementation for Apache HTTP Server versions 2.0, 2.2, and future 2.4. This version of mod_fcgid is a bug fix release.

A fix is included for CVE-2010-3872, a potential vulnerability which can affect sites with untrusted FastCGI applications.

Additionally, default configuration settings for request body handling have been changed to prevent large system resource use. Administrators of all versions of mod_fcgid are strongly cautioned to ensure that FcgidMaxRequestLen is configured appropriately.

For information about this module subproject, see the mod_fcgid module project page.

A patch is available here for a regression in this release. The patch has not been applied to the Windows binaries.

The Apache HTTP Server Project is pleased to announce the release of Apache FTP module for Apache HTTP Server, version 0.9.6 as beta.

Users are encouraged to test and provide feedback on this beta release. For information about this module subproject, see the mod_ftp module project page.

It is essential that you verify the integrity of the downloaded files using the PGP or MD5 signatures. Please read Verifying Apache HTTP Server Releases for more information on why you should verify our releases.

The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these files from the main distribution directory, rather than from a mirror. Then verify the signatures using

% pgpk -a KEYS
% pgpv httpd-2.2.0.tar.gz.asc
or
% pgp -ka KEYS
% pgp httpd-2.2.0.tar.gz.asc
or
% gpg --import KEYS
% gpg --verify httpd-2.2.0.tar.gz.asc

Alternatively, you can verify the MD5 signature on the files. A unix program called md5 or md5sum is included in many unix distributions. It is also available as part of GNU Textutils. Windows users can get binary md5 programs from here, here, or here. An MD5 signature consists of 32 hex characters, and a SHA1 signature consists of 40 hex characters. Ensure your generated signature string matches the signature string published in the files above.