CVE-2026-44185 is a buffer over-read vulnerability in Apache HTTP Server (2.4.0 through 2.4.67) occurring during outbound Online Certificate Status Protocol (OCSP) requests. If the server connects to a malicious OCSP responder controlled by an attacker, the attacker can exploit this flaw to read sensitive memory contents or cause a denial of service by crashing the server. The vulnerability arises from improper bounds checking when processing OCSP responses. The risk is contingent on the server's OCSP configuration and the trust level of the OCSP responders it communicates with. The issue is fixed in Apache HTTP Server version 2.4.68. Red Hat advisories confirm the vulnerability and recommend upgrading or disabling OCSP validation/stapling if not required.

An attacker controlling an OCSP server can cause the Apache HTTP Server to read memory beyond intended bounds, potentially leaking sensitive information such as cryptographic keys or personally identifiable information. Additionally, the attacker can trigger a denial of service by causing the server to crash. The confidentiality, integrity, and availability of the server are all impacted to a low degree according to the CVSS score. The actual impact depends on the server's OCSP configuration and whether it communicates with untrusted OCSP responders.

A fix is available in Apache HTTP Server version 2.4.68; users should upgrade to this version to remediate the vulnerability. Alternatively, if OCSP validation or stapling is not critical, administrators can mitigate the risk by configuring Apache HTTP Server to disable OCSP and stapling via mod_ssl directives: set SSLOCSPEnable off and SSLUseStapling off, then reload the httpd service. It is also recommended to ensure that OCSP responders are trusted endpoints to reduce exposure.