Apache HTTP Server’s mod_md module processes OCSP responses without imposing a limit on the size of the data it receives. When an attacker supplies an oversized or malicious OCSP response, the module allocates memory proportional to that response, which can exhaust the server’s available resources. The effect is a denial of service that can halt or severely degrade the HTTP server for all users. This is a resource allocation flaw without limits, identified as CWE‑770. The CVSS score is 7.3.

The vulnerability is present in Apache HTTP Server versions 2.4.30 through 2.4.66, which include the mod_md module. Any deployment that enables mod_md to perform OCSP validation is affected. The vendor is the Apache Software Foundation and the product is Apache HTTP Server.

The CVSS score is 7.3, indicating a high potential impact. EPSS is not available and this issue is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Based on the description, the likely attack vector is remote and would require an attacker to trigger OCSP response handling by sending a large or malformed OCSP payload to the server. The inference is that the module must be reachable over the network and that the attacker can influence the content of the OCSP response it processes.