CVE-2026-33007— Apache HTTP Server: mod_authn_socache crash
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33007
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache HTTP Server: mod_authn_socache crash
Source: NVD (National Vulnerability Database)
Vulnerability Description
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
空指针解引用
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.0 ~ 2.4.66 | - |
II. Public POCs for CVE-2026-33007
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33007
Please Login to view more intelligence information
Same Patch Batch · Apache Software Foundation · 2026-05-04 · 17 CVEs total
| CVE-2026-42810 | 9.9 CRITICAL | Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or |
| CVE-2026-42811 | 9.9 CRITICAL | Apache Polaris: could broaden vended GCS credentials through unescaped identifier content |
| CVE-2026-42809 | 9.9 CRITICAL | Apache Polaris: staged table creation could vend storage credentials for unvalidated locat |
| CVE-2026-42812 | 9.9 CRITICAL | Apache Polaris: No protection on `write.metadata.path` |
| CVE-2026-40682 | Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor | |
| CVE-2026-42027 | Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader | |
| CVE-2026-42440 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader | |
| CVE-2026-40563 | Apache Atlas: Script injection allows access to unintended data | |
| CVE-2026-29169 | Apache HTTP Server: mod_dav_lock indirect lock crash | |
| CVE-2026-23918 | Apache HTTP Server: http2: double free and possible RCE on early reset | |
| CVE-2026-33006 | Apache HTTP Server: mod_auth_digest timing attack | |
| CVE-2026-33523 | Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status | |
| CVE-2026-33857 | Apache HTTP Server: Off-by-one OOB reads in AJP getter functions | |
| CVE-2026-34032 | Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination C | |
| CVE-2026-34059 | Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data | |
| CVE-2026-24072 | Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr |
IV. Related Vulnerabilities
Same product: Apache HTTP Server
- CVE-2026-28780
Apache HTTP Server: buffer overflow in mod_proxy_ajp via aj - CVE-2026-29168
Apache HTTP Server: mod_md unrestricted OCSP response - CVE-2026-29169
Apache HTTP Server: mod_dav_lock indirect lock crash - CVE-2026-23918
Apache HTTP Server: http2: double free and possible RCE on e - CVE-2026-33006
Apache HTTP Server: mod_auth_digest timing attack
Same vendor: Apache Software Foundation
- CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro - CVE-2026-25077
Apache CloudStack: Unauthenticated Command Injection in Dire - CVE-2025-69233
Apache CloudStack: Domain/account resources limits not honor - CVE-2025-66467
Apache CloudStack: MinIO policy remains intact on bucket del
Same weakness: CWE-476
- CVE-2026-42183
Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference - CVE-2026-6666
PgBouncer crash in kill_pool_logins_server_error - CVE-2026-41684
Incus: Nil Dereferences on Restore via Malformed YAML - CVE-2026-41647
Incus: Nil-Pointer Dereference via S3 Bucket Import - CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update messa
V. Comments for CVE-2026-33007
No comments yet