Executive brief
Apache HTTP Server is a widely used web server for hosting websites and applications. A security flaw in how the server handles certificate status checks (OCSP) could allow a malicious server to send a specially crafted response that causes the Apache server to read more data than intended. This could potentially lead to a service crash or the exposure of small amounts of sensitive information from the server's memory.
Technical details
A stack-based buffer over-read vulnerability exists in the mod_ssl module of Apache HTTP Server, specifically within the send_request function used for OCSP (Online Certificate Status Protocol) validation. The flaw is triggered when the server makes an outbound OCSP request to an attacker-controlled OCSP responder that returns a crafted response. An attacker can exploit this to read beyond the allocated buffer on the stack, potentially causing a process crash or leaking memory contents. The vulnerability affects versions 2.4.0 through 2.4.67 and is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-04-27: disclosed: Reported to security team
- 2026-06-03: patched: Fixed in 2.4.x branch
- 2026-06-08: advisory: Public advisory and version 2.4.68 released