Servers and applications

CVE-2026-106023

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Severity: High
Published: 11 Nov 2026
Last changed: 11 Nov 2026
Added to UpHeron: 11 Nov 2026
Weakness: Null pointer dereference (CWE-476)
Sources: CVE Program

Description

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.
This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

From the CVE Program.

Affected software

Software	Affected versions
Apache HTTP ServerServers and applications · `cna:apache software foundation\|apache http server`	From 2.4.30 up to 2.4.70

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-106023