CVE-2026-44185
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
CVSS Score
7.3
EPSS Score
0.6%
EPSS Percentile
45th
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
| CWE | CWE-126 |
| Vendor | apache software foundation |
| Product | apache http server |
| Published | Jun 8, 2026 |
| Last Updated | Jul 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache http server
Be the first to know when new high vulnerabilities affecting apache software foundation apache http server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache HTTP Server
2.4.0 ≤ 2.4.67
References
httpd.apache.org: https://httpd.apache.org/security/vulnerabilities_24.html openwall.com: http://www.openwall.com/lists/oss-security/2026/06/08/12 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-44185 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2486397 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44185.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34109 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42828 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41906 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25042
Credits
Zhenpeng (Leo) Lin at depthfirst