CVE-2026-44185

What it actually does

Apache HTTP Server versions 2.4.0 through 2.4.67 contain a buffer over-read in handling outbound OCSP requests made by the server to an OCSP responder. If Apache is configured to perform OCSP-related certificate status checks and is induced to contact an attacker-controlled OCSP responder, a crafted OCSP response can cause Apache to read beyond the intended memory buffer. The likely effects are limited memory disclosure, request or worker-process instability, and potential corruption of OCSP validation behavior, reflected by the CVSS low confidentiality, integrity, and availability impacts. The issue is remotely reachable in configurations where Apache makes outbound OCSP requests based on certificate metadata or OCSP configuration, and it does not require attacker authentication.

Why it matters to the business

Organizations running vulnerable Apache HTTP Server versions may face service instability, failed TLS certificate validation workflows, or limited exposure of process memory if a malicious OCSP responder is contacted. Internet-facing Apache deployments are common, but practical exposure depends on whether OCSP functionality is enabled and whether the server can be made to contact an attacker-controlled responder. The vulnerability is not currently listed in CISA KEV, has no known ransomware association, and has a low EPSS score, so immediate mass exploitation is not indicated; however, Apache HTTP Server is widely deployed and should be upgraded during the next prioritized maintenance window, sooner for systems using OCSP validation, mutual TLS, reverse proxy TLS validation, or outbound internet access to arbitrary OCSP responders.

How an attack unfolds

An attacker first identifies an Apache HTTP Server running an affected 2.4.x release and determines whether the deployment performs outbound OCSP checks, such as OCSP stapling retrieval, client-certificate OCSP validation, or other TLS certificate status validation paths. The attacker then arranges for Apache to contact an OCSP responder under attacker control, for example by using certificate material or certificate chains that reference a malicious OCSP responder URL, or by targeting configurations that permit OCSP lookups to externally supplied responder locations. When Apache sends the outbound OCSP request, the attacker-controlled responder returns a malformed or specially crafted OCSP response that triggers the buffer over-read during parsing. Successful exploitation may cause Apache worker crashes, abnormal TLS handshake or certificate-validation failures, or limited exposure of adjacent process memory depending on how the over-read is handled and whether the response data is surfaced, logged, or otherwise observable to the attacker.

How to fix it

Upgrade Apache HTTP Server to version 2.4.68 or later. Where Apache is supplied by an operating system vendor or appliance vendor, install the vendor-provided security update that backports the fix, even if the displayed upstream version remains below 2.4.68. Prioritize systems that use mod_ssl with OCSP functionality, mutual TLS, reverse proxy TLS validation, or unrestricted outbound access to OCSP responders. As interim mitigations, restrict outbound HTTP/HTTPS egress from Apache hosts to known trusted OCSP responder domains, avoid accepting certificate chains from untrusted parties that can force OCSP lookups to arbitrary responder URLs, use configured trusted OCSP responders where operationally feasible, and disable nonessential OCSP features until patched. Relevant Apache configuration areas to review include SSLUseStapling, SSLStaplingCache, SSLOCSPEnable, SSLOCSPDefaultResponder, SSLOCSPOverrideResponder, and any proxy or TLS client-certificate validation settings that can trigger outbound certificate-status checks.

How to confirm the fix worked

Confirm the installed Apache HTTP Server build is fixed by checking the runtime and package version with commands such as `httpd -v`, `apache2 -v`, `apachectl -v`, `rpm -q httpd`, `dpkg -l apache2`, or the equivalent vendor package query. The upstream fixed version is 2.4.68; for distribution packages, verify the vendor advisory states that the CVE is fixed or backported. Review loaded modules and configuration for OCSP exposure using `apachectl -M` or `httpd -M` and configuration searches for `SSLUseStapling`, `SSLStaplingCache`, `SSLOCSPEnable`, `SSLOCSPDefaultResponder`, and `SSLOCSPOverrideResponder`. Validate that outbound egress from Apache hosts is limited to expected OCSP responders where possible. After upgrading, restart or gracefully reload Apache and confirm no old vulnerable worker processes remain running. If a test environment is available, repeat certificate-validation or OCSP-stapling workflows and confirm normal operation without OCSP parser errors, worker crashes, or TLS handshake failures.

Typical attack path

1. Identify Apache HTTP Server instances running versions 2.4.0 through 2.4.67.
2. Confirm or infer that mod_ssl OCSP functionality is enabled, such as OCSP stapling, OCSP validation for client certificates, or outbound OCSP checks during TLS certificate validation.
3. Prepare certificate material, a certificate chain, or an OCSP responder URL that causes the server to make an outbound OCSP request to infrastructure controlled by the attacker.
4. Operate a malicious OCSP responder that returns a crafted OCSP response designed to trigger the buffer over-read.
5. Initiate the TLS or certificate-validation workflow that causes Apache to perform the outbound OCSP request.
6. Observe effects such as Apache child-process crashes, TLS handshake failures, OCSP validation errors, or possible leakage of limited memory-adjacent data.

How to detect it

To assess whether exploitation may have occurred, review Apache error logs, SSL/TLS logs, system journals, crash dumps, and outbound proxy or firewall logs for evidence that Apache contacted unusual OCSP responder hosts followed by TLS errors or worker-process crashes. Relevant log sources include Apache `error_log` or `ssl_error_log`, systemd journal entries for `httpd` or `apache2`, kernel logs for segmentation faults, core dump metadata from `coredumpctl`, endpoint telemetry for `httpd` or `apache2` crashes, and egress DNS/proxy/firewall logs showing OCSP requests to unfamiliar domains. Look for temporal correlation between outbound OCSP HTTP requests and messages referencing OCSP response parsing, certificate status validation failures, TLS handshake failures, child process exits, segmentation faults, or repeated Apache worker restarts. Because the vulnerability description does not define a unique exploit payload, detection should focus on suspicious OCSP destinations, malformed OCSP response errors, and crash patterns rather than a single definitive signature.

• SSLUseStapling
• SSLOCSPEnable
• SSLOCSPDefaultResponder
• SSLOCSPOverrideResponder
• OCSP
• OCSP response
• OCSP responder
• certificate status
• AH019
• AH022
• AH026
• segfault at
• httpd: segfault
• apache2: segfault
• coredumpctl info httpd
• coredumpctl info apache2
• /var/log/httpd/error_log
• /var/log/apache2/error.log
• /var/log/httpd/ssl_error_log
• /var/log/apache2/ssl_error.log
• /var/lib/systemd/coredump/
• httpd
• apache2

What your security team should do

• Inventory Apache HTTP Server deployments and prioritize any running 2.4.0 through 2.4.67.
• Upgrade affected deployments to Apache HTTP Server 2.4.68 or vendor-patched packages.
• Prioritize patching for internet-facing servers, mutual TLS endpoints, reverse proxies, and hosts with OCSP functionality enabled.
• Review Apache TLS and OCSP configuration for `SSLUseStapling`, `SSLOCSPEnable`, `SSLOCSPDefaultResponder`, and `SSLOCSPOverrideResponder`.
• Restrict outbound network access from Apache servers to approved certificate authority and OCSP responder endpoints.
• Monitor Apache error logs, TLS handshake failures, and process crash telemetry for anomalous OCSP-related errors.
• Confirm that service restarts removed vulnerable worker processes after patching.
• Track vendor advisories for distribution-specific fixed package versions and backport status.