High (7.5). EPSS 56% chance of exploitation in the next 30 days.
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Severity
CVSS 3.0
7.5 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
56% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)