APACHE HTTP SERVER · CVE-2026-106023 · Runtime
NO FIX YET · SEE WHAT TO DO
A NULL pointer dereference in Apache HTTP Server's mod_md module can crash the server while it handles an HTTP request. The sources do not say whether an attacker can use it for more than a denial of service.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Apache HTTP Server from 2.4.30 through 2.4.69 that load the mod_md module are in the affected range. The sources do not say whether the flaw is reachable by default or only with specific settings, so unknown. Servers running other versions or without mod_md are not in the stated range.
Not affected if mod_md-not-loaded, version-outside-2.4.30-2.4.69
Who cares apache-httpd, mod_md, self-hosted
httpd -v and compare it to the affected range 2.4.30 through 2.4.69.httpd -M | grep md_module (Debian/Ubuntu: apache2ctl -M).NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.
This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.