CVE-2026-33007

Analyzed Analyzed - Analysis Complete

NULL pointer dereference in Apache HTTP Server

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: Apache Software Foundation

Description

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-05-04

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33007

Affected Vendors & Products

Vendor	Product	Version / Range
apache	http_server	From 2.4.0 (inc) to 2.4.67 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the mod_authn_socache module of Apache HTTP Server versions 2.4.66 and earlier.

It allows an unauthenticated remote user to cause a crash of a child process when the server is configured as a caching forward proxy.

Impact Analysis

The impact of this vulnerability is that an unauthenticated remote attacker can crash a child process of the Apache HTTP Server.

This can lead to denial of service conditions, affecting the availability of the server.

Mitigation Strategies

Users are recommended to upgrade to Apache HTTP Server version 2.4.67, which fixes this issue.

Hi! I’m here to help you understand CVE-2026-33007. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70