CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Q: Which deployments are affected?

Apache HTTP Server installations using mod_md are affected if they run a version from 2.4.30 through 2.4.69. The provided information does not state whether mod_md is enabled by default.

Q: What is the practical impact of exploitation?

The NULL pointer dereference occurs during HTTP request processing and can crash an Apache child process. The provided information does not establish impacts beyond child-process denial of service.

Q: What access does an attacker need?

The issue is triggered during HTTP request processing, indicating that an attacker would need to be able to send HTTP requests to the affected server. No authentication or other prerequisite is specified in the provided data.

Published Nov 11, 2026

Updated

modmd NULL pointer dereference leads to child process crash

Other sources

NULL pointer dereference vulnerability in Apache HTTP Server's modmd during HTTP request processing.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

— MITRE

Affected Software

4 affected components

debian/apache2*

debian/apache2<=2.4.68-1~deb12u1, <=2.4.67-1~deb12u3, <=2.4.68-1~deb13u1, <=2.4.69-1~deb13u1, <=2.4.69-1, <=2.4.70-1

Event History

Nov 11, 2026

CVE Published

via OSV·02:47 PM

Data Sourced

via OSV·02:47 PM

DescriptionAffected Software

CVE Published

via MITRE·02:55 PM

Data Sourced

via MITRE·02:55 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Apache HTTP Server installations using mod_md are affected if they run a version from 2.4.30 through 2.4.69. The provided information does not state whether mod_md is enabled by default.

What is the practical impact of exploitation?

The NULL pointer dereference occurs during HTTP request processing and can crash an Apache child process. The provided information does not establish impacts beyond child-process denial of service.

What access does an attacker need?

The issue is triggered during HTTP request processing, indicating that an attacker would need to be able to send HTTP requests to the affected server. No authentication or other prerequisite is specified in the provided data.

CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Other sources

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What is the practical impact of exploitation?

What access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What is the practical impact of exploitation?

What access does an attacker need?