Vulnerability · high
Apache HTTP Server mod_md NULL pointer crash (CVE-2026-106023)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apache HTTP Server 2.4.30–2.4.70 deployments using mod_md
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
The Brief
- CVE-2026-106023 is a NULL pointer dereference in Apache HTTP Server's mod_md module during HTTP request processing.
- The flaw crashes the child process handling requests.
- Affected versions are Apache HTTP Server 2.4.30 through 2.4.70, per the oss-security post, which is rated important.
Why it matters
Servers running affected 2.4.x releases with mod_md can have request-handling child processes crashed by a NULL pointer dereference. The source does not describe a fix or workaround.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Apache HTTP Server is a web server that developers and ops teams run in production. |
| No | Core infrastructure | Judgment: Apache httpd is widely deployed but is a single product, not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Apache HTTP Server is a mainstream, widely deployed web server used by many teams. |
| No | Exploited in the wild | Open Source Security advisory describes only a crash bug; no source reports observed attacks. |
| No | Public exploit | Open Source Security advisory: no source says exploit code or a proof-of-concept is published. |
| No | Remote, no login | Open Source Security: crash occurs during HTTP request processing; no source states it needs no authentication. |
| No | Full takeover | Open Source Security: NULL pointer dereference causes child process crash, which is denial of service, not code execution. |
| No | Secrets exposed | Open Source Security advisory reports a crash only; no data exposure is mentioned. |
| No | Supply chain | Open Source Security advisory describes a normal bug in legitimate code, not malicious code shipped through a trusted channel. |
| No | No fix yet | Open Source Security advisory does not say whether a fixed version is unavailable; no source reports no patch. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-476
Timeline
CVE-2026-106023 disclosed on the oss-security mailing list
Open Source Security
CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
Source
CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash ↗ Open Source Security · 1h ago
First seen · 1 source · Full story page · How tiers are decided