This vulnerability is a stack buffer over-read that occurs in the OCSP resend logic within Apache HTTP Server’s mod_ssl module when sending outbound OCSP requests. The over-read can allow sensitive data from adjacent memory to be inadvertently exposed and can trigger an application crash, thereby disrupting service availability. No evidence indicates this flaw offers code execution or privilege escalation capabilities; its principal consequence is loss of service continuity and potential information leakage.

The affected product is Apache HTTP Server, produced by the Apache Software Foundation. All releases from version 2.4.0 through 2.4.67 contain the flaw, while 2.4.68 and later versions contain the fix.

An attacker can trigger the vulnerability by controlling an OCSP responder that the server contacts and by inducing the web server to issue a request, for example via a crafted HTTPS connection. Because the exploit relies on outbound traffic to a server controlled by the attacker, it is a remote, network‑based vulnerability. No EPSS score is available and the flaw is not listed in the CISA KEV catalogue, suggesting that it is not currently widely exploited. The CVSS score of 7.3 indicates moderate to high severity. The severity of a crash or information leak, while disruptive, is lower than a remote code‑execution flaw, but the possibility of denial of service remains significant.