← CVE Intelligence

CVE-2026-44185

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` PUBLISHED

Description (CNA)

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache HTTP Serveraffected 2.4.0 through 2.4.67

CWE

CWE-126

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

redhat-SADP

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.