International
The Morning Dev

Only the news worth knowing

‹
 

SecurityFan score 21 · Tier C

CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

oss-security ·

The Brief

  • CVE-2026-106023 is a NULL pointer dereference in Apache HTTP Server's mod_md module during HTTP request processing.
  • The flaw crashes the child process handling requests.
  • Affected versions are Apache HTTP Server 2.4.30 through 2.4.70, per the oss-security post, which is rated important.

Why it matters

Servers running affected 2.4.x releases with mod_md can have request-handling child processes crashed by a NULL pointer dereference. The source does not describe a fix or workaround.

Who’s affected

  • Operators running Apache HTTP Server 2.4.30 through 2.4.70 with mod_md
  • Apache HTTP Server 2.4.30
  • Apache HTTP Server 2.4.70
  • CVE-2026-106023
  • #apache
  • #http-server
  • #mod-md
  • #vulnerability
  • #null-pointer
  • #cve-2026-106023

Posted by Eric Covener on Nov 11 Severity: important Affected versions: - Apache HTTP Server 2.4.30 through 2.4.70 Description: NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from…

Read the full story at seclists.org ↗

Timeline

  1. CVE-2026-106023 disclosed on the oss-security mailing list

  2. Open Source Security

    CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

How do you feel about this?

0 Comments

    CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash – The Morning Dev