untrusted comment: verify with openbsd-77-base.pub
RWSbCCUoGpcxVUnAwNG2urUSy+/6dLNBaSWBLDHIukz/4qZM5/kmDnQ1aSPUXyT0RGI6L5L7WwuWsChuCEyhA5wQRLe3fC7RIw0=

OpenBSD 7.7 errata 019, February 2, 2026:

Fix a use-after-free in httpd(8) when using chunked encoding.

Apply by doing:
    signify -Vep /etc/signify/openbsd-77-base.pub -x 019_httpd.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install httpd:
    cd /usr/src/usr.sbin/httpd
    make obj
    make
    make install

Index: usr.sbin/httpd/server_http.c
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/server_http.c,v
diff -u -p -r1.155 server_http.c
--- usr.sbin/httpd/server_http.c	22 Dec 2024 13:51:42 -0000	1.155
+++ usr.sbin/httpd/server_http.c	26 Jan 2026 18:40:34 -0000
@@ -660,7 +660,8 @@ server_read_httpchunks(struct buffereven
 		goto done;
 	if (EVBUFFER_LENGTH(src))
 		bev->readcb(bev, arg);
-	bufferevent_enable(bev, EV_READ);
+	else
+		bufferevent_enable(bev, EV_READ);
 	return;
 
  done: