UnratedApache Software Foundation

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

CVE-2026-44185 Published Jun 8, 2026Updated by vendor Jul 15, 2026

CVE-2026-44185

Affected products & platforms

Apache Software FoundationHTTP Server

Summary

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images.

What this means

In plain English

Vulnerable items

Apache HTTP Server — Apache HTTP Server is a widely deployed web server for serving and proxying HTTP traffic.
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images

Recommended action

Primary action: update to a vendor-listed fixed release: 2.4.68.

Rewritten locally from the scraped official advisory data above; no generative API is used. The vendor advisory is authoritative.

Affected versions

Apache HTTP Server 2.4.0 through 2.4.67

Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

2.4.68

Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 2.4.68. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source

Source evidence

What VulniPulse actually used to build this record — and why.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
Apache Software Foundation
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-44185NVD CVE.org MITRE

Official resources

Apache HTTP Server 2.4 vulnerabilities (official fixed-in table) (target: 2.4.68)
Official documentation
This advisory names 2.4.68 as the first fixed release — official upgrade documentation for Apache HTTP Server 2.4 vulnerabilities (official fixed-in table).
ASF Security — reporting & CVE process
Official documentation
The Apache Software Foundation's official security page: how ASF CVEs are published and where each project's advisories live.
Apache project downloads (fixed releases)
Official documentation
Official ASF download tree — fetch the fixed release named in this advisory from the project's directory.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

CVE-2026-44185 Published Jun 8, 2026Updated by vendor Jul 15, 2026

Affected products & platforms

Apache Software FoundationHTTP Server

Summary

What this means

In plain English

Vulnerable items

Apache HTTP Server — Apache HTTP Server is a widely deployed web server for serving and proxying HTTP traffic.
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images

Recommended action

Primary action: update to a vendor-listed fixed release: 2.4.68.

Rewritten locally from the scraped official advisory data above; no generative API is used. The vendor advisory is authoritative.

Affected versions

Apache HTTP Server 2.4.0 through 2.4.67

Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

2.4.68

Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 2.4.68. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · medium-confidence parse· fetched 2 hours ago·verify at source

Source evidence

What VulniPulse actually used to build this record — and why.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
Apache Software Foundation
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-44185NVD CVE.org MITRE

Official resources

Apache HTTP Server 2.4 vulnerabilities (official fixed-in table) (target: 2.4.68)
Official documentation
This advisory names 2.4.68 as the first fixed release — official upgrade documentation for Apache HTTP Server 2.4 vulnerabilities (official fixed-in table).
ASF Security — reporting & CVE process
Official documentation
The Apache Software Foundation's official security page: how ASF CVEs are published and where each project's advisories live.
Apache project downloads (fixed releases)
Official documentation
Official ASF download tree — fetch the fixed release named in this advisory from the project's directory.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.