PT-2026-37041 · Apache+2 · Apache Http Server+2

Pavel Kohout · Published 2026-03-02 · Updated 2026-06-20 · CVE-2026-29168

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.30 through 2.4.66

Description An issue exists in the mod md module where resource allocation occurs without limits or throttling when processing OCSP response data. OCSP (Online Certificate Status Protocol) is a protocol used to determine the current revocation status of a digital certificate.

Recommendations Upgrade to version 2.4.67.

Fix

DoS

Allocation of Resources Without Limits

NULL Pointer Dereference

Weakness Enumeration

CWE-770

CWE-476

Related Identifiers

BDU:2026-06409

BIT-APACHE-2026-29168

CVE-2026-29168

OESA-2026-2316

OESA-2026-2318

OESA-2026-2319

OESA-2026-2320

OESA-2026-2401

OPENSUSE-SU-2026:10785-1

SUSE-SU-2026:22199-1

SUSE-SU-2026:22209-1

USN-8239-1

Affected Products

Apache Http Server

Linuxmint

Ubuntu

References · 77

• https://ubuntu.com/security/CVE-2026-33857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28780 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-29168 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33523 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-29168 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2320 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-29168 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33007 · Security Note
• https://ubuntu.com/security/CVE-2026-33007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29168 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22209-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33857 · Security Note