CVE-2026-44185: Apache HTTP Server Buffer Over-read via OCSP – Patch to 2.4.68

Technical summary

CVE-2026-44185 is a buffer over-read vulnerability (CWE-125, CWE-126) in Apache HTTP Server's OCSP request handling. When Apache initiates outbound OCSP requests to validate client or peer certificates, an attacker-controlled OCSP server can return a malformed response that triggers out-of-bounds memory access in the server's response parsing logic. The vulnerability stems from insufficient bounds checking when processing OCSP responses. An attacker must either compromise or spoof an OCSP responder that the target Apache instance trusts. The buffer over-read can leak sensitive data from adjacent memory regions, corrupt internal state, or crash the server process.

Business impact

Organizations running vulnerable Apache HTTP Server versions may experience confidentiality breaches if OCSP responses are intercepted or manipulated, potential data leakage through memory disclosure, and service interruptions from crashes. For infrastructure relying on Apache for critical applications (web services, APIs, reverse proxies), exploitation could lead to unplanned downtime and exposure of sensitive information. The impact is heightened in environments with strict certificate validation policies or where OCSP stapling is not employed.

Affected systems

Apache HTTP Server versions 2.4.0 through 2.4.67 are affected. This encompasses most modern production deployments of Apache 2.4.x unless already patched. The vulnerability only manifests when the server is configured to make outbound OCSP requests, typically for client certificate validation or peer validation in reverse proxy scenarios. Default configurations with OCSP validation enabled or explicitly configured are at risk.

Exploitability

Exploitation requires network access to OCSP traffic or the ability to impersonate an OCSP responder that the target Apache server trusts. The attack vector is network-based with low complexity—no special privileges or user interaction needed. However, the attacker must successfully intercept or spoof OCSP communications, which is non-trivial in properly secured networks. The CVSS score of 7.3 (HIGH) reflects the combination of network-based attack surface, low attack complexity, and potential for multiple impact types (confidentiality, integrity, availability).

Remediation

Upgrade Apache HTTP Server to version 2.4.68 or later, which includes the fix for this buffer over-read vulnerability. Organizations unable to patch immediately should review OCSP configuration: disable OCSP validation if not operationally necessary, use OCSP stapling to reduce outbound OCSP requests, or implement network segmentation to restrict OCSP responder communication paths. Monitor logs for unexpected OCSP request failures or crashes related to certificate validation.

Patch guidance

Apply Apache HTTP Server version 2.4.68 as soon as feasible. Verify compatibility with your current modules and configurations before deploying to production. Test the patched version in a staging environment to ensure no regressions with certificate validation workflows. Package managers (apt, yum, apk) typically lag behind upstream releases by days to weeks; check your distribution's security advisories for availability. Prioritize patching systems handling client certificates or operating as reverse proxies.

Detection guidance

Monitor Apache error logs for segmentation faults (SIGSEGV) or abnormal termination during OCSP requests. Track OCSP request and response patterns—sudden spikes in failures or malformed response messages may indicate exploitation attempts. Use network intrusion detection to identify malicious OCSP responses or traffic anomalies. Review Apache access and SSL/TLS logs for unusual certificate validation behavior. Consider deploying memory-safety tools (AddressSanitizer) in staging to catch buffer violations before production exposure.

Why prioritize this

This vulnerability rates HIGH severity due to its network-accessible attack vector, low complexity, and potential for information disclosure combined with service disruption. While exploitation requires specific conditions (attacker-controlled OCSP server or traffic interception), the prevalence of Apache in production environments and the increasing use of client certificate authentication make it a meaningful risk. Patch quickly, especially for infrastructure handling sensitive data or critical services.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects: Network-based attack vector (AV:N) with no authentication required (PR:N, UI:N), low attack complexity (AC:L), and impacts across confidentiality (C:L), integrity (I:L), and availability (A:L). The score does not account for the requirement to control an OCSP responder, which would reduce real-world exploitability in well-segmented networks. Threat actors with network positioning (ISP-level, BGP hijacking, DNS poisoning) would find this practical to exploit.

Frequently asked questions