This vulnerability is a stack buffer over-read that occurs in the OCSP resend logic within Apache HTTP Server’s mod_ssl module when sending outbound OCSP requests. The over-read can expose sensitive data from adjacent memory and may trigger an application crash, leading to service disruption. The flaw is a classic buffer over-read (CWE-125) that also involves an out-of-bounds write (CWE-126). No evidence indicates this vulnerability can be used for code execution or privilege escalation; its principal consequence is loss of service continuity and potential information leakage.

The affected product is Apache HTTP Server, produced by the Apache Software Foundation. All releases from version 2.4.0 through 2.4.67 contain the flaw, while 2.4.68 and later versions contain the fix.

An attacker can trigger the vulnerability by controlling an OCSP responder that the server contacts and by inducing the web server to issue a request, for example via a crafted HTTPS connection. The exploit relies on outbound traffic to a server controlled by the attacker, making it a remote, network‑based vulnerability. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The flaw is not listed in the CISA KEV catalogue, suggesting that it is not currently widely exploited. The CVSS score of 7.3 indicates moderate to high severity. The severity of a crash or information leak, while disruptive, is lower than a remote code‑execution flaw, but the possibility of denial of service remains significant.