CVE-2026-33007

What it actually does

CVE-2026-33007 is a denial-of-service vulnerability in Apache HTTP Server's mod_authn_socache module. In Apache HTTP Server 2.4.66 and earlier, an unauthenticated remote client can trigger a NULL pointer dereference when the server is operating in a caching forward proxy configuration. Successful exploitation crashes an Apache child process. The impact is availability-focused: confidentiality and integrity are not directly affected, and exploitation does not provide code execution or privilege escalation based on the available information.

Why it matters to the business

Organizations using Apache HTTP Server as a caching forward proxy may experience service instability, failed requests, reduced proxy capacity, or intermittent outages if the vulnerability is triggered repeatedly. Because Apache typically uses multiple worker or child processes, a single crash may be self-recovering, but sustained triggering can degrade availability and increase operational load. The CVSS score is moderate, EPSS is currently low and flat, it is not listed in CISA KEV, and there is no known ransomware association, so urgency is primarily driven by whether affected Apache instances are exposed as caching forward proxies.

How an attack unfolds

An attacker first identifies an Apache HTTP Server instance that is reachable over the network and configured as a caching forward proxy using mod_authn_socache. The attacker then sends a specially crafted unauthenticated request that reaches the vulnerable authentication cache handling path. Due to improper handling of a NULL pointer condition, the Apache child process handling the request dereferences a NULL pointer and crashes. The attacker does not need valid credentials or user interaction. Repeating the request can cause recurring child process crashes, leading to degraded service, elevated error rates, and possible denial of service depending on traffic volume, MPM configuration, process limits, and restart behavior.

How to fix it

Upgrade Apache HTTP Server to version 2.4.67 or later. Prioritize systems configured as caching forward proxies or systems loading mod_authn_socache. If immediate upgrade is not possible, reduce exposure by disabling forward proxy functionality where it is not required, restricting proxy access to trusted networks, disabling or reconfiguring affected authentication caching functionality if operationally feasible, and applying rate limiting or upstream filtering for suspicious proxy requests. Ensure package-managed installations are updated through the operating system vendor or distribution channel once fixed builds are available.

How to confirm the fix worked

Confirm the installed Apache HTTP Server version is 2.4.67 or later, or that the vendor-supplied package includes the backported fix. Review Apache configuration for forward proxy behavior, such as ProxyRequests On, and for use of mod_authn_socache or authentication caching directives. Validate that untrusted clients cannot access forward proxy functionality. After patching or mitigation, perform controlled testing to ensure proxy authentication and caching behavior continue to function and that crafted unauthenticated proxy requests do not crash child processes. Monitor error logs and process supervision logs for continued child process crashes after remediation.

Typical attack path

1. Scan for internet-facing or network-accessible Apache HTTP Server instances.
2. Identify servers behaving as forward proxies, especially caching forward proxies.
3. Send unauthenticated crafted proxy requests that exercise mod_authn_socache behavior.
4. Trigger the NULL pointer dereference in the Apache child process handling the request.
5. Repeat the request to cause recurring child process crashes and degrade availability.

How to detect it

To determine whether exploitation may have occurred, review Apache error logs, system journals, core dump records, and process supervisor logs for child process crashes or segmentation faults associated with proxy requests. Focus on systems running Apache HTTP Server 2.4.66 or earlier with forward proxy and authentication caching enabled. Look for repeated worker or child exits, SIGSEGV messages, core dumps for httpd or apache2, sudden bursts of 500-series errors, and access log entries showing unauthenticated forward proxy requests immediately before crashes. Correlate crash timestamps with access logs containing absolute-form proxy requests, CONNECT attempts, unusual Proxy-Authorization behavior, or repeated requests from the same source. No public exploit-specific payload strings are available from the provided data, so detection should emphasize crash patterns and proxy request correlation rather than a single signature.

• AH00052: child pid
• exit signal Segmentation fault
• exit signal SIGSEGV
• segmentation fault
• core dumped
• httpd
• apache2
• ProxyRequests On
• mod_authn_socache
• CONNECT
• Proxy-Authorization:
• GET http://
• POST http://

What your security team should do

• Inventory Apache HTTP Server deployments and identify any instances running 2.4.66 or earlier.
• Prioritize remediation for Apache instances configured as caching forward proxies or reachable from untrusted networks.
• Upgrade affected systems to Apache HTTP Server 2.4.67 or a vendor-fixed package version.
• Disable or restrict forward proxy functionality unless it is explicitly required.
• Confirm mod_authn_socache usage and remove or reconfigure it where it is unnecessary.
• Add monitoring for repeated Apache child process crashes, segmentation faults, abnormal exits, and spikes in proxy-related 4xx/5xx responses.
• Because EPSS is low, exploit maturity is currently listed as none, and the vulnerability is not in KEV, handle as a moderate-priority availability issue unless critical proxy infrastructure is exposed.