There's a fix for a buffer overrun vulnerability in the httpd daemon but we don't ship it (CVE-2019-11356).