The package libapreq2 was orphaned with revision 2.17-1.

Description: generic Apache request library
  The generic Apache request library (APR) contains modules for manipulating
  client request data with the Apache API from Perl and C. Functionality
  includes:
  .
   - parsing of application/x-www-form-urlencoded data
   - parsing of multipart/form-data
   - parsing of HTTP Cookies

Apache has pulled the plug in libapreq2:

"
  The libapreq2 library is no longer being maintained or developed by the
  Apache HTTP Server project, following a vote of the Project Management
  Committee. There will be no future libapreq2 releases by this project.
  Existing users should consider migrating to alternative software.

  Project resources will continue to be available in a read-only state:

  * GitHub repository: https://github.com/apache/apreq
  * Mailing list: https://lists.apache.org/list?apreq-dev@httpd.apache.org
  * Historic release archive: https://archive.apache.org/dist/httpd/libapreq/

   - Joe Orton, on behalf of the Apache HTTP Server PMC
"
https://lists.apache.org/thread/bhk82b4h0ffm9vdrdoym9yr6ghrx6jtt


The package should be removed from Debian.

Control: clone -1 -2
Control: reassign -2 src:libapreq2
Control: found -2 libapreq2/2.17-8
Control: severity -2 serious

Lets start by copying this bug to src:libapreq2 and making it
serious there, leading to eventual removal from testing.

C