HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
apache
httpd
C2012–2026
apache / httpd

httpd

Apache HTTP Server

Web DevelopmentSystems & InfrastructureNetworking
Explore on GitHubRead Hacker News discussions
17Distinct people
17Mentions
0Explicit recommenders
4.1KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Apache HTTP Server

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 11:56:56 AM UTC.

Critical RCE Vulnerability in Apache HTTP Server direct repository linkDebated

The discussion centers on whether the Apache HTTP Server vulnerability should be classified as a Remote Code Execution (RCE) given that no public proof-of-concept exists, with users split between those citing industry norms and vendor claims versus those demanding demonstrated exploitability. A secondary debate concerns the role of AI in discovering the bug and the ongoing preference for Apache over Nginx due to features like .htaccess despite performance criticisms.

193 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4

Mentions over time

HN mentions by year17 dated mentions

Observed mentions: 2012-09-06 06:22:14 UTC to 2026-10-15 03:24:04 UTC.

012342012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments20122013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC321
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC000
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC000
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC101
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC000
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC101
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC101
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC202
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC413
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

17 sources
Izkata·Oct 15, 2026
It really shouldn't be, this error page should be familiar looking: https://i.sstatic.net/FRlUG.png It comes from ap_send_error_response(), near the bottom starting at https://github.com/apache/httpd/blob/b2dc966be4178ded1499d5d... Scrolling up from there a bit you can see some of the handling for ErrorDocument, which is configurable ( https://httpd.apache.org/docs/current/custom-error.html ) but also loses the original response body. ap_send_error_response() is only called from the last line of ap_die_r() ( https://github.com/apache/httpd/blob/b2dc966be4178ded1499d5d... ), as the fallback for errors when none of the other conditions pass. There's some other handling for redirects and custom ErrorDocument, but again, if it reaches those it's using the contents of "custom_response" instead of the original response body. ap_die_r() is cal
Read the rest
led unconditionally for completed requests ( https://github.com/apache/httpd/blob/b2dc966be4178ded1499d5d... ), which is why api_die_r() starts with an early return for an OK or DONE response. Its wrapper ap_die() is also used in plenty of other locations as a general error handler. It's been a while so I had to go through it again, the code isn't exactly what I'm half remembering, but I do remember the "assbackwards" lines in ap_send_error_response() ( https://github.com/apache/httpd/blob/b2dc966be4178ded1499d5d... and https://github.com/apache/httpd/blob/b2dc966be4178ded1499d5d... ). If the particular check I think I remember did exist (explicit status codes in an "if", similar to your earlier link), it was probably in the even older version we were using. The early return I'm pretty sure wasn't there (blame puts it at 12 years old), so all responses would have gone through more of the error handling code back then. Edit: Replacing "trunk" branch with most recent commit so line numbers continue to work in the future
In The gap in shared understanding of LLM capability is widening
firesteelrain·Jul 24, 2025
I'm not going to be all high and mighty then say that tests should have caught this since Apache has tests. I am not sure why RewriteCond expr is even valid at all since expr typically needs an expression to come after it like RewriteCond expr "'cache/%{md5:%{REQUEST_URI}?%{QUERY_STRING}}.html' =~ /(.+)/". The bug appeared to be introduced on July 7 with a backport from trunk: https://github.com/apache/httpd/blame/ed99ef021de902363c36af... It took me a second but the fix addresses the case where rc==0. If statement is less than 0. Therefore, rc==0 should indicate no match. https://github.com/apache/httpd/commit/8abb3d06b23975705ebcf... I suppose because there is also the conditional for err?
In Apache HTTP Server: 'RewriteCond expr' always evaluates to true
kevincox·Jul 24, 2025
It seems like the bug was originally introduced here: https://github.com/apache/httpd/commit/dd98030cb399e962aa605... This is seemingly a well-intentioned cleanup that misunderstood the branching logic. The original code was normalizing `rc < 0` to COND_RC_NOMATCH (0), but leaving `rc >= 0` as the original value. However the new code accidentally normalizes `rc >= 0` to COND_RC_MATCH (1) while it should be normalizing `rc > 0` to COND_RC_MATCH (leaving 0 as COND_RC_NOMATCH). There are a few other logic changes in this patch which should likely be reviewed carefully. For example https://github.com/apache/httpd/commit/dd98030cb399e962aa605... does `rc <= COND_RC_MATCH` which matches both match and no match. Presumably it is checking for COND_RC_STATUS_SET but it seems like and odd way to write `rc == COND_RC_STATUS_SET`. Maybe the intention
Read the rest
is to match future special values?
In Apache HTTP Server: 'RewriteCond expr' always evaluates to true
js2·Nov 19, 2022
Early in my career, in the late 90s, I was at Cox Interactive Media on the team responsible for the web farm which hosted all of Cox Enterprises news sites: newspapers, radio stations, TV stations. This was before the days of SREs and SROs and dev-ops. We were just system admins and programmers and some of us could do both. The web farm was about two-dozen Sun Ultra 2s connected on a FDDI loop (we eventually upgraded to GigE), with content on NetApps (4GB drives). A couple Sun E450s. Apache[1] on the Ultra 2s. Apache + mod_perl on the E450s. Hosted at a Global Center DC in Sunnyvale (same DC that early Yahoo was hosted in). Monitoring with MRTG[2]. It's 1998. The Ken Starr report drops. Now, we knew it was coming, and we did our best to be prepared, but this is the late 90s. There was only so much load testing we could do and didn't reall
Read the rest
y know how much traffic it would drive. We kept the site up, but it meant, as I recall, a lot of fine tuning of the mod_perl box and disabling interactive parts[3] of the site. I really wish I still had some of the traffic graphs. Fun times. [1] Receipt: https://github.com/apache/httpd/blob/1.3.x/src/CHANGES#L5754 [2] Receipt: https://github.com/oetiker/mrtg/blob/master/src/CHANGES#L310... [3] The forums. OMG forum software was so terrible. I think we eventually wrote our own after nothing based on Netscape Application Server or that we found open source worked well at all.
In Mystery Blips
iBotPeaches·Sep 24, 2021
This was an interesting security patch that marked the first time in my memory that updating Apache led to an immediate regression. A few hours after taking this upgrade many systems experienced such strange timeout errors. Connections were low and couldn't pinpoint the misleading behavior that looked like a slowloris attack, with no connections. Half a day later with no resolution in research a new patch [1] was available and problem resolved. [1] https://github.com/apache/httpd/commit/8720881b0634383145e87...
In Developers fix multitude of vulnerabilities in Apache HTTP Server
jaredklewis·Apr 26, 2019
Yea, webpack sure is horrible. Not like C/C++ programs, where we have a super simple setup of Make, config, and autoconf. Like checkout this easy-peasy Make file: https://github.com/apache/httpd/blob/trunk/Makefile.in . Even a child could understand it. Or look at Java. Who has ever seen a complicated ant or pom file? No one ever. This Lucene ant file practically wrote itself: https://github.com/apache/lucene-solr/blob/master/lucene/bui... /s I guess my snarky point is that build systems are complicated. It's like the Bjarne Stroustrup about programming languages. There are two kinds of build systems: the ones people complain about the ones no body uses. Robust build systems have to handle the nearly endless combinations of different requirements each app brings to the table...complexity is table stakes. Modern web apps are built to be ab
Read the rest
le to run on a myriad of different platforms, as they have to maintain compatibility between tons of version of several different browsers running on a slew of different device types running different operating systems. Did we think that was going to be easy? People like to shit on webpack, but I don't get it. It's a well thought out tool that works extremely well. And what are the alternatives? Yes, yes, yes, I know, your blog/website/thing you have is just plain ol' html and and you stick some javascript in a script tag or whatever. No need for any of these fancy build scripts, blah, blah. So what? That's like telling the people at lucene that all this arcane index stuff is overkill because you just search your hard drive using ripgrep. You can't make a real app like Slack, Spotify, VS Code, or Google Docs without a serious build process. People are making photoshop, for the browser. They're not going to do it with ES3 they write directly into a script tag.
In Stepping Away from Sass
sigjuice·Oct 21, 2017
The world mostly does it the other way. A couple of code examples: https://github.com/apache/httpd/blob/trunk/server/provider.c https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... Almost all documentation, references and literature: Here are a couple of man pages. http://man7.org/linux/man-pages/man3/gethostbyname.3.html https://developer.apple.com/library/mac/documentation/Darwin... Here is a draft of the ISO C standard: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1124.pdf
In Object oriented programming with ANSI-C (1993) [pdf]
pquerna·Feb 21, 2017
Good blog post explaining the behavior of glibc, I also saw this first hand when profiling Apache awhile back too: http://mail-archives.apache.org/mod_mbox/httpd-dev/201111.mb... https://github.com/apache/httpd/blob/trunk/server/util_time.... The internals of glibc can often be pretty surprising sometimes, I'd really encourage people to go spelunking into the glibc source when they are profiling applications.
In How setting the TZ environment variable avoids thousands of system calls

Showing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.