Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

published 2026-11-11 19h ago modified 2026-11-11 15h ago also EUVD-2026-123534

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.

This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Patch / fix

distros 1

apache2 Alpine 3.24 2.4.71-r0

alpine advisories ALPINE-CVE-2026-106023

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-106023 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected products

Apache Software Foundation Apache HTTP Server

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Apache HTTP Server rss critical rss

References

httpd.apache.org /security/vulnerabilities_24.html
vendor-advisory
openwall.com /lists/oss-security/2026/11/11/11

Sources

CVE List CVE-2026-106023
NVD CVE-2026-106023

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.