mod_h2 v2.0.37

• Prevent double purge of a stream, resulting in a double free.
• Restore use of streams own memory allocator.

mod_h2 v2.0.36

• Revert change from v2.0.33 that gave streams their own memory
  allocator after report of problems in PR 69899.
• Hardening: use nghttp2 supplied length when checking trailers.

mod-h2 v2.0.35

• New directive H2MaxStreamErrors to control how much bad behaviour by clients is tolerated before the connection is closed.

mod-h2 v2.0.34

• Added support for "ProxyErrorOverride" directive in mod_proxy_http2.
• Fix a bug in calculating the log2 value of integers, used in push
  diaries and proxy window size calculations. Apache PR69741.
  [Benjamin P. Kallus]

mod_h2 v2.0.33

• Fixes CVE-2025-53020 (https://www.cve.org/CVERecord?id=CVE-2025-53020)
  where a client can increase memory consumption for a HTTP/2 connection
  via repeated request header names,leading to denial of service.
• Fixes CVE-2025-49630 (https://www.cve.org/CVERecord?id=CVE-2025-49630)
  where in certain proxy configurations whith mod_proxy_http2 as the
  backend, an assertion can be triggered by certain requests, leading
  to denial of service.

mod_h2 v2.0.32

• The connection window size was set wrong, preventing H2WindowSize to work. Fixed #300.

mod_h2 v2.0.31

• mod_proxy_http2: revert r1912193 for detecting broken backend connections
  as this interferes with backend selection who a node is unresponsive.
  PR69624.
• Fix issue with handling 304 responses from mod_cache. PR69580.

mod-h2 v2.0.30

• Fixed bug in handling over long response headers. When the 64 KB limit
  of nghttp2 was exceeded, the request was not reset and the client was
  left hanging, waiting for it. Now the stream is reset.
• Added new directive H2MaxHeaderBlockLen to set the limit on response
  header sizes.
• Fixed handling of Timeout vs. KeepAliveTimeout when first request on a
  connection was reset.

mod-h2 v2.0.29

• fixed a compiler warning about an unused static var when AP_MPMQ_CAN_WAITIO is not defined.

mod-h2 v2.0.28

• When HTTP/2 flow controls blocks further writes, return processing to an
  async mpm to free a worker thread. The connection needs window updates from
  the client in such a case and can leave monitoring the socket to the mpm.
  So far, only effective on Apache httpd 2.5.0 (trunk).
  [ylavic, icing]
• Backport fix of CVE-2024-36387 from Apache 2.4.60.