CVE-2026-44185: Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

Synopsis

A stack buffer over-read vulnerability exists in the mod_ssl module of Apache HTTP Server versions 2.4.0 through 2.4.67, triggered via outbound OCSP requests sent to an attacker-controlled OCSP responder. The flaw is reachable over the network with no authentication required and no user interaction needed, as the server itself initiates the outbound OCSP request during certificate validation. Successful exploitation gives an attacker limited read, write, and availability impact against the affected server process. Although the CVE description references 2.4.68 as the fix, no fix version has been formally published in this record, so HarborGuard is tracking the advisory for confirmed patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a reachable OCSP responder over the network that the Apache server contacts during outbound certificate-status validation.

• AuthenticationNot required

  No authentication is required; the server initiates the OCSP request without any credential check against the remote responder.

• Victim interactionNot required

  No human victim interaction is needed; the server's own OCSP validation logic triggers the vulnerable code path automatically.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or specific environmental configuration beyond controlling an OCSP responder endpoint.

Blast Radius

• Reads a limited portion of stack memory from the Apache server process, which may expose fragments of in-memory data such as TLS session state or partial request buffers.
• Achieves limited writes, with potential to corrupt adjacent stack data in the affected server worker process.
• Disrupts availability of the affected worker process, which can degrade or crash request handling for connections that trigger OCSP validation.
• Impact is scoped to the individual server instance; the vulnerability does not cross privilege boundaries to the host OS in the current scoring.