Apache HTTP Server mod_md NULL pointer deref before 2.4.70
CVE-2026-106023 Published on November 11, 2026

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Vendor Advisory NVD

Timeline

2026-09-29

reported

Weakness Type

NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.

Products Associated with CVE-2026-106023

Want to know whenever a new CVE is published for Apache HTTP Server? stack.watch will email you.

Apache HTTP Server

Affected Versions

Apache Software Foundation Apache HTTP Server: