This vulnerability (CVE-2026-44185) involves a buffer over-read in Apache HTTP Server triggered by outbound OCSP requests directed to a malicious OCSP server controlled by an attacker. It affects versions 2.4.0 through 2.4.67 of Apache HTTP Server. The issue is resolved in version 2.4.68. Red Hat's advisory confirms the vulnerability and provides updated packages for Red Hat Enterprise Linux 10 to remediate the issue. The CVSS 3.1 base score is 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to cause a buffer over-read in the Apache HTTP Server, potentially leading to information disclosure, integrity loss, or denial of service. The vulnerability arises when the server makes outbound OCSP requests to an attacker-controlled OCSP server. The CVSS score of 7.3 reflects a high severity impact affecting confidentiality, integrity, and availability.

A fix is available in Apache HTTP Server version 2.4.68. Users should upgrade to this version to remediate the vulnerability. Red Hat has released updated httpd packages for Red Hat Enterprise Linux 10 that include the fix. Administrators should apply these updates promptly following vendor guidance. No additional mitigations are specified by the vendor advisory.