CVE-2026-44185

A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.

A critical buffer over-read flaw in Apache HTTP Server occurs when it performs outbound OCSP requests. If a server connects to an attacker-controlled OCSP responder, a remote attacker can leak sensitive memory data or trigger a denial of service (DoS). This risk depends entirely on the server's OCSP configuration and endpoint trustworthiness.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration.

For example, add or modify the following lines:

SSLOCSPEnable off
SSLUseStapling off

After modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections:

sudo systemctl reload httpd