From 403269396d24404e2576a9b20f96cd0b10574048 Mon Sep 17 00:00:00 2001
From: Eric Covener <covener@apache.org>
Date: Fri, 5 Jun 2026 10:07:34 +0000
Subject: [PATCH] Merge r1935007 from trunk:

ap_proxy_cookie_revers: fix dup path/domain


Reviewed By: covener, jailletc36, jfclere


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1935008 13f79535-47bb-0310-9956-ffa450edef68

Conflict:no
Reference:https://github.com/apache/httpd/commit/403269396d24404e2576a9b20f96cd0b10574048
---
 modules/proxy/proxy_util.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
index 00fedb1adfb..81b7de2a695 100644
--- a/modules/proxy/proxy_util.c
+++ b/modules/proxy/proxy_util.c
@@ -1036,6 +1036,12 @@ PROXY_DECLARE(const char *) ap_proxy_cookie_reverse_map(request_rec *r,
             poffs = pathp - tmpstr_orig;
             l1 = strlen(pathp);
             pathe = str + poffs + l1;
+            /*
+             * RFC 6265 § 5.3 7): Only the last path= should be meaningful
+             * so reset anything previously found.
+             */
+            newpath = NULL;
+            pdiff = 0;
             if (conf->interpolate_env == 1) {
                 ent = (struct proxy_alias *)rconf->cookie_paths->elts;
             }
@@ -1056,6 +1062,12 @@ PROXY_DECLARE(const char *) ap_proxy_cookie_reverse_map(request_rec *r,
             doffs = domainp - tmpstr_orig;
             l1 = strlen(domainp);
             domaine = str + doffs + l1;
+            /*
+             * RFC 6265 § 5.3 4): Only the last domain= should be meaningful
+             * so reset anything previously found.
+             */
+            newdomain = NULL;
+            ddiff = 0;
             if (conf->interpolate_env == 1) {
                 ent = (struct proxy_alias *)rconf->cookie_domains->elts;
             }