untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWVjjhrFJRi33xlBAJystdNERtZfXIptwh0pKJKvBLkqFIPG6gmEWvoZmCVzr8n47PigX8aqKoxNVhGJWtn0vZQM=

OpenBSD 7.8 errata 013, February 2, 2026:

Fix a use-after-free in httpd(8) when using chunked encoding.

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 013_httpd.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install httpd:
    cd /usr/src/usr.sbin/httpd
    make obj
    make
    make install

Index: usr.sbin/httpd/server_http.c
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/server_http.c,v
diff -u -p -r1.155 server_http.c
--- usr.sbin/httpd/server_http.c	22 Dec 2024 13:51:42 -0000	1.155
+++ usr.sbin/httpd/server_http.c	26 Jan 2026 18:39:04 -0000
@@ -660,7 +660,8 @@ server_read_httpchunks(struct buffereven
 		goto done;
 	if (EVBUFFER_LENGTH(src))
 		bev->readcb(bev, arg);
-	bufferevent_enable(bev, EV_READ);
+	else
+		bufferevent_enable(bev, EV_READ);
 	return;
 
  done: