Re: Crash in Version 2.4.57 with OpenSSL 3.1.4

On 27/3/25 19:21, Soujanya Rai wrote:
> Hello,
> 
> Apache HTTP Version: 2.4.57
> 
> In our Org, we are currently in the process of upgrading OpenSSL
> version to 3.1.6 and httpd is being run as a multi-threaded process.
> 
> Occasionally we are seeing crashes with backtrace in the OpenSSL code,
> usually related to double-freeing of OpenSSL structures. From our
> communications with OpenSSL devs, it is due to multiple threads
> accessing/modifying non-thread-safe structures in OpenSSL library. As
> per them, the onus is on the application to ensure thread safety.
> 
> Are we aware of any such issue with multi-threading with the latest
> version of OpenSSL 3.x?
> Is there any additional config changes required in the Apache code to
> support it?
> 
> Thank you for your time,
> smrai
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
> 


3.x is a bit wide

In my experience there is the 3.0 LTS branch with gives me no trouble in 
dozens of servers.

But about 3.x there is also 3.2, 3.3, 3.4 and future LTS 3.5. 3.1 is not 
even mentioned in their page as a current or supported release, I would 
stay away from it.

If you want a stable environment I would stick with LTS 3.0.x


-- 
-Daniel
Find help at #httpd in Libera.chat