What changed in Apache Server 2.4 Windows Site STIG V2R3V2R3 changes

Apache Server 2.4 Windows Site STIG V2R3 (2026-04-01) replaced V2R2 (2025-04-02): 20 checks removed, 1 updated. It has 16 checks, against 36 in V2R2.

V2R3 checklistV2R2 checklist Compare V2R2 and V2R3 in STIG Compare

  • 0 added
  • 20 removed
  • 1 updated

Updated fields: CCIs 1Check text 1Discussion 1

Removed since V2R2 (20)

  • V-214362CAT IIThe Apache web server must limit the number of allowed simultaneous session requests.
  • V-214363CAT IIThe Apache web server must perform server-side session management.
  • V-214364CAT IIThe Apache web server must produce log records containing sufficient information to establish what type of events occurred.
  • V-214366CAT IIThe Apache web server must have resource mappings set to disable the serving of certain file types.
  • V-214369CAT IIThe Apache web server must be configured to use a specified IP address and port.
  • V-214370CAT IIThe Apache web server must perform RFC 5280-compliant certification path validation.
  • V-214375CAT IIThe Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.
  • V-214377CAT IIThe Apache web server must accept only system-generated session identifiers.
  • V-214378CAT IIThe Apache web server must generate unique session identifiers that cannot be reliably reproduced.
  • V-214379CAT IIThe Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
  • V-214381CAT IIThe Apache web server must be configured to provide clustering.
  • V-214384CAT IIWarning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.
  • V-214385CAT IIDebugging and trace information used to diagnose the Apache web server must be disabled.
  • V-214386CAT IIThe Apache web server must set an absolute timeout for sessions.
  • V-214387CAT IIThe Apache web server must set an inactive timeout for completing the TLS handshake.
  • V-214391CAT IIThe Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).
  • V-214392CAT IIThe Apache web server must be tuned to handle the operational requirements of the hosted application.
  • V-214393CAT IIThe Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.
  • V-214396CAT IAn Apache web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
  • V-214397CAT IIIThe Apache web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Updated in V2R3 (1)

V-214390CAT IIThe Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.Check text, Discussion, CCIs

Check text

Review the webwebsite server documentation and deployment configuration to determine which ports and protocols are enabled. Verify the ports and protocols being used are permitted, are necessary for the operation of the web server and the hosted applications, and are secure for a production system. OpenReview both the &lt'INSTALLED PATH'>1conf1httpd.conf fileand the &lt'INSTALLED PATH'>1conf1extra1httpd-ssl.conf files. Verify only the listener for IANA well-known ports for HTTP and HTTPS (80 and 443) are in use. If any of the ports or protocols are not permitted, are nonsecure, or are not necessary for webwebsite server operation, this is a finding.

Discussion

Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system. The web server must provide the capability to disable or deactivate network-related services that are deemed tononessential be non-essential to the server mission, are too unsecure, or are prohibited by the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments. Configuring the web server to implement organizationwide security implementation guides and security checklists guarantees compliance with federal standards and establishes a common security baseline across the DOD that reflects the most restrictive security posture consistent with operational requirements. Satisfies: SRG-APP-000516-WSR-000174, SRG-APP-000383-WSR-000175

CCIs

CCI-001762CCI-001762,CCI-000366

V-214390 in V2R3

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.