CLEANSTART-2026-GS47054 By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault

🗓️ 09 Oct 2026 00:49:56Reported by GoogleType

osv-cleanstart🔗 osv.dev👁 4 Views

NULL pointer dereference in apache2 mod_md challenge handler causes child process segfault.

Reporter	Title	Published	Views	Family All 57
ALT Linux	Security fix for the ALT Linux 8 package apache2 version 1:2.4.34-alt1	31 Jul 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package apache2 version 1:2.4.34-alt1	31 Jul 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package apache2 version 1:2.4.34-alt1	31 Jul 201800:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Vulnerabilities CVE-2018-1333 and CVE-2018-8011 in the IBM i HTTP Server affect IBM i.	8 Aug 201815:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache Tomcat, Open SSL, and Apache HTTPD affects Rational Build Forge	21 Nov 201822:55	–	ibm
FreeBSD	Apache httpd -- multiple vulnerabilities	18 Jul 201800:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : httpd (ALAS-2018-1062)	24 Aug 201800:00	–	nessus
Tenable Nessus	Amazon Linux AMI : httpd24 (ALAS-2018-1062)	24 Aug 201800:00	–	nessus
Tenable Nessus	Apache 2.4.x < 2.4.34 Multiple Vulnerabilities	16 Aug 201800:00	–	nessus
Tenable Nessus	Fedora 28 : httpd (2018-49d3b42425)	3 Jan 201900:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GS47054.json
osv	www.osv.dev/vulnerability/CVE-2018-8011
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-8011

09 Oct 2026 01:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 37.5

EPSS0.55608

apache2 mod_md NULL pointer dereference segfault