Moderate Vulnerability in mod_md: Unrestricted OCSP Response Leading to Resource Exhaustion
Summary
ALSA-2026:30845: Moderate: mod_md security update. Affects mod_md versions < 1:2.4.26-5.el10_2.1. Fixed in 1:2.4.26-5.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
mod_md is a module designed for managing common properties of domains across one or more virtual hosts. It leverages the ACME protocol to automate the provisioning of SSL/TLS certificates, ensuring that certificates for managed domains and their virtual hosts are configured automatically, including during renewal processes. This functionality is critical for maintaining secure communications over the internet.
Vulnerability Detail
The vulnerability identified as CVE-2026-29168 pertains to an unrestricted OCSP (Online Certificate Status Protocol) response within the mod_md module. This flaw can lead to resource exhaustion, potentially allowing an attacker to overwhelm the server by sending crafted requests that exploit this weakness. The implications of this vulnerability can be severe, as it may result in denial of service, affecting the availability of services relying on the affected module.
How To Fix
Minimum fixed version
1:2.4.26-5.el10_2.1
This is the first release that contains the fix.
sudo dnf update mod_mdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on your server to mitigate the impact of potential exploitation attempts until the package can be updated. This can be done by configuring your web server settings to limit the number of requests from a single IP address.
Conclusion
The mod_md module has a moderate vulnerability that could lead to resource exhaustion due to unrestricted OCSP responses. It is crucial to update to the patched version to mitigate risks. Implementing workarounds such as rate limiting can provide temporary relief until the update is applied.
See every vulnerability recorded for mod_md →
FAQ
mod_md is an Apache module that automates the management of SSL/TLS certificates for domains and virtual hosts using the ACME protocol.
CVE-2026-29168 refers to a security vulnerability in mod_md that allows unrestricted OCSP responses, leading to potential resource exhaustion.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to resource exhaustion, which may cause denial of service, impacting the availability of services that rely on the affected module.
It is recommended to regularly check for updates and apply them promptly to ensure that your software is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for mod_md.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
