A NULL pointer dereference in the mod_authn_socache component of Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to cause a child process to crash when the server is configured as a caching forward proxy. This flaw does not provide code execution, but it can be used to interrupt service by repeatedly triggering child process failures, leading to widespread denial of service. The weakness is a classic null pointer dereference (CWE‑476).

The impact applies to the Apache Software Foundation’s Apache HTTP Server product. All releases up to and including version 2.4.66 are affected. Users are advised to upgrade to version 2.4.67, which contains the fix.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation in the wild to date. However, the flaw can be triggered by any unauthenticated remote user via standard HTTP traffic to a proxy instance that uses mod_authn_socache, making the risk moderate to high for exposed servers, as reflected by a CVSS score of 5.3. The lack of public exploitation does not reduce the severity of the impact, as service disruption can have significant operational consequences. The advisement is to treat it as a significant risk that merits prompt remediation.