Apache mod_md NULL dereference can crash a child process
Original title: CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
Apache rates CVE-2026-106023 important; the body limits it to 2.4.30 through 2.4.69.
A NULL pointer dereference in Apache HTTP Server's mod_md during HTTP request processing can crash a child process. Eric Covener's post marks the issue important. The subject lists 2.4.30 through 2.4.70, while the description says 2.4.30 through 2.4.69. Finders include researchers from 360 Vulnerability Research Institute. No fix or exploitation is stated.
Unconfirmed: The subject and description disagree on whether 2.4.70 is affected.
- Vendor severity is important.
- The crash occurs during HTTP request processing in mod_md.
- The description ends the affected range at 2.4.69.
- The subject line extends the range through 2.4.70.
Impact: NULL dereference crashes an Apache child process
| Product | Affected |
|---|---|
| Apache Software Foundation Apache HTTP Server | 2.4.30 through 2.4.69; subject says through 2.4.70 |
- CVEs
- CVE-2026-106023
- Vendors
- Apache Software Foundation
- Products
- Apache HTTP Servermod_md
- Organizations
- 360 Vulnerability Research Institute
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106023 | NULL pointer dereference in Apache HTTP Server mod_md | — | — |
From the original article
Posted by Eric Covener on Nov 11 Severity: important Affected versions: - Apache HTTP Server 2. 4. 30 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.