Skip to content

lighttpd-prerelease

PRE-RELEASE: lighttpd 1.4.36~rc1

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:

Please test it as much as possible and provide us with feedback.\ A lot of testing ensures a good release.

Important changes
  • [ssl] disable SSL3.0 by default
  • escape all strings for logging
  • fix segfault when temp file for upload couldn’t be created (found by coverity)
  • changes to the internal API for buffers, chunks and more; 3rd party plugins are likely to break

PRE-RELEASE: lighttpd 1.4.33rc1-r2901

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:

Please test it as much as possible and provide us with feedback.\ A lot of testing ensures a good release.

PRE-RELEASE: lighttpd 1.4.27rc2-r2758

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.27rc2-r2758.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.27rc2-r2758.tar.bz2
SHA1 checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.27rc2-r2758.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

New changes since rc1:

We fixed a race condition with mod_cgi responses; and a similar problem in mod_proxy (forward response as soon at it is available).

There is a new fdevent handler “libev”; “linux-rtsig” got removed. The “libev” handler should support solaris ports, so it might be especially interesting on solaris.

And the last commit changes a small bit how we handle IPv6; we now disable the “dual-stack” IPv6 sockets in almost all cases, see IPv6-Config for details.

Changes already in rc1:

The most important change is the SSL_CTX_set_options fix, as lighttpd\ doesn’t start without it if you use a recent ssl library; most distributions included it with 1.4.26 for a while now.

We hope to have fixed some problems with mod_proxy and we really hope TLS SNI works now, and lighty doesn’t use the wrong certs anymore; it would be nice if you could test this :)

We fixed a segfault in mod_compress; if you disable etags, mod_compress won’t try to cache on disk anymore (and doesn’t set etag).

If no showstoppers are encountered, there will be a final release soon.

PRE-RELEASE: lighttpd 1.4.27rc1-r2724

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.27rc1-r2724.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.27rc1-r2724.tar.bz2
SHA1 checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.27rc1-r2724.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

The most important change is the SSL_CTX_set_options fix, as lighttpd doesn’t start without it if you use a recent ssl library; most distributions included it with 1.4.26 for a while now.

We hope to have fixed some problems with mod_proxy and we really hope TLS SNI works now, and lighty doesn’t use the wrong certs anymore; it would be nice if you could test this :)

We fixed a segfault in mod_compress; if you disable etags, mod_compress won’t try to cache on disk anymore (and doesn’t set etag).

If no showstoppers are encountered, there will be a final release soon.

PRE-RELEASE: lighttpd 1.4.26rc1-r2710

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.26rc1-r2710.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.26rc1-r2710.tar.bz2
SHA1 checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.26rc1-r2710.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

There have been some important bug fixes (request parser handling for splitted header data, a fd leak in mod_cgi, a segfault with broken configs in mod_rewrite/mod_redirect and of course the latest security issue with an OOM vulnerability)

If no showstoppers are encountered, there will be a final release soon.

PS: As it is often asked in the comments: We don’t plan to release 1.5, as we are working on 2.0; we can’t support too many different versions, so while we are still trying to keep 1.5 working, our main efforts will be keeping 1.4 stable and working on 2.0 for now.

PRE-RELEASE: lighttpd 1.4.25rc1-r2692

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.25rc1-r2692.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.25rc1-r2692.tar.bz2
SHA1 checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.25rc1-r2692.sha1sum

Please test it as much as possible and provide us with feedback. A lot of testing ensures a good release.

We did some important bug fixes (some of them new since 1.4.24, and some older bugs). Only 2 small new features: traceback for lua errors and the SSL_CLIENT_* vars export for ssl client cert validation.

If no showstoppers are encountered, there will be a final release soon.

PRE-RELEASE: lighttpd 1.4.24rc2-r2668

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.24rc2-r2668.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.24rc2-r2668.tar.bz2
SHA1 checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.24rc2-r2668.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

Since rc1 we fixed another fastcgi bug, escape accesslog data and fixed a crash in webdav (which got introduced in rc1)

Already in rc1: We have made many changes, especially regarding the core of our connection state machine (hopefully fixing the lingering socket close, which should fix pipelining), and the FastCGI internals (it should recover from crashing FastCGI applications)

There are two new features for SSL too: TLS SNI and client certificate validation.

If no showstoppers are encountered, there will be a final release soon.

PRE-RELEASE: lighttpd 1.4.24rc1-r2656

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.24rc1-r2656.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.24rc1-r2656.tar.bz2
SHA1 checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.24rc1-r2656.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.

We have made many changes, especially regarding the core of our connection state machine (hopefully fixing the lingering socket close, which should fix pipelining), and the FastCGI internals (it should recover from crashing FastCGI applications)
There are two new features for SSL too: TLS SNI and client certificate validation.

If no showstoppers are encountered, there will be a final release soon.

PRE-RELEASE: lighttpd 1.4.23rc2-r2534 + new 1.5 snapshot

As a quick followup to release candidate #1 of 1.4.23, here comes #2.

You can get 1.4.23rc2-r2534 from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc2-r2534.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc2-r2534.tar.bz2
Checksums:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc2-r2534.sha256sum
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc2-r2534.sha1sum
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc2-r2534.md5sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.
If no showstoppers are encountered, there will be a final release soon.

Additionaly, we have created a new 1.5 snapshot 1.5.0snap-r2533.
It contains an important fix for a remote crash bug (only in 1.5) when ssl is used.

PRE-RELEASE: lighttpd 1.4.23rc1-r2522

We would like to draw your attention to the latest pre-release of the stable 1.4 branch of lighttpd.

You can get the pre-release from these urls:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc1-r2522.tar.gz
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc1-r2522.tar.bz2
SHA1 checksum:
https://download.lighttpd.net/lighttpd/snapshots-1.4.x/lighttpd-1.4.23rc1-r2522.sha1sum

Please test it as much as possible and provide us with feedback.
A lot of testing ensures a good release.
If no showstoppers are encountered, there will be a final release soon.