Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes the issue.
3. httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server
A flaw was found in Apache HTTP Server. This buffer over-read vulnerability occurs when the server processes outbound Online Certificate Status Protocol (OCSP) requests directed to an attacker-controlled OCSP server. This could allow a remote attacker to read sensitive information from memory or cause a denial of service.
RHSA-2026:47046: Red Hat Enterprise Linux AppStream EUS (v. 10.0)
RHSA-2026:34109: Red Hat Enterprise Linux AppStream (v. 10)
RHSA-2026:42828: Red Hat Enterprise Linux AppStream (v. 8)
RHSA-2026:41906: Red Hat Enterprise Linux AppStream (v. 9)
RHSA-2026:25042: Red Hat Hardened Images
Configurations
Workarounds
To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration.
For example, add or modify the following lines:
~~~
SSLOCSPEnable off
SSLUseStapling off
~~~
After modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections:
~~~
sudo systemctl reload httpd
~~~