NULL Pointer Dereference in Apache HTTP Server's mod_md during HTTP Request Processing
CVE-2026-106023

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Http Server
Vendor
CVE Published:
11 November 2026

What is CVE-2026-106023?

A NULL pointer dereference vulnerability exists in the mod_md module of Apache HTTP Server, which can be triggered during the processing of HTTP requests. This flaw may lead to system instability or application failures when handling specially crafted requests, possibly allowing attackers to affect the server's performance or availability.

Affected Version(s)

Apache HTTP Server 2.4.30 <= 2.4.70

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hexb1n, Yang Song, and JiaSheng He of 360 Vulnerability Research Institute, working with 360 TuLongFeng.
Lucian Nitescu
Bartlomiej Dmitruk at striga.ai
.