CVE-2026-44185
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS probability
- 0.74%
- CWE
- CWE-126
- Published
- 2026-06-08
- Last modified
- 2026-09-14
Affected products
- Apache Software Foundation Apache HTTP Server
Weakness type
Related vulnerabilities
- CVE-2017-17772 — Multiple buffer overread vulnerabilities in WLAN
- CVE-2025-60003 — Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash
- CVE-2024-33056 — Buffer Over-read in MProc
- CVE-2024-33047 — Buffer Over-read in Display
- CVE-2018-5852 — Buffer Over-read in IPA
- CVE-2024-45552 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21488 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21487 — Buffer Over-read in Data Network Stack & Connectivity