Apache mod_md NULL dereference can crash a child process
Apache rates CVE-2026-106023 important; the body limits it to 2.4.30 through 2.4.69.
48
CVE-2026-106023
NULL pointer dereference in Apache HTTP Server mod_md
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A NULL pointer dereference in Apache HTTP Server’s mod_md occurs during HTTP request processing and can crash a child process. It affects servers from 2.4.30 through 2.4.69 that use mod_md. An attacker who can send HTTP requests to such a server may trigger the crash, denying service for that child process. Apache has not listed a fixed version.
What to do: Apache has not listed a fixed version for CVE-2026-106023. Apply Apache’s update for this CVE when one is published.
| Product | Affected |
|---|---|
| Apache HTTP Server | 2.4.30 through 2.4.69 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.
- Weakness
- CWE-476