# CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/660) · 2026-11-11 · Security
Page: https://themorning.dev/story/cve-2026-106023-apache-http-server-mod-md-null-pointer-dereference-leads-to-chil-7cfed7fed3688182
Kind: security · Impact: medium

## In brief

- CVE-2026-106023 is a NULL pointer dereference in Apache HTTP Server's mod_md module during HTTP request processing.
- The flaw crashes the child process handling requests.
- Affected versions are Apache HTTP Server 2.4.30 through 2.4.70, per the oss-security post, which is rated important.

## Why it matters

Servers running affected 2.4.x releases with mod_md can have request-handling child processes crashed by a NULL pointer dereference. The source does not describe a fix or workaround.

## Versions

- Apache HTTP Server 2.4.30
- Apache HTTP Server 2.4.70

## CVEs

- CVE-2026-106023

## Timeline

- 2026-11-11: CVE-2026-106023 disclosed on the oss-security mailing list

## Coverage

- [CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash](https://seclists.org/oss-sec/2026/q4/660) — Open Source Security, 2026-11-11

Tags: apache, http-server, mod-md, vulnerability, null-pointer, cve-2026-106023

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev