Apache HTTP Server EUVD-2026-27321

Upgrade to Apache HTTP Server 2.4.67, which contains the complete fix for this resource allocation vulnerability. The official vendor advisory at https://httpd.apache.org/security/vulnerabilities_24.html provides download links and upgrade instructions. For environments where immediate patching is not feasible, disable the mod_md module entirely if ACME-based certificate automation is not required (using 'a2dismod md' on Debian-based systems or commenting out LoadModule directives). This workaround eliminates the attack surface but requires reverting to manual certificate management workflows, including manual renewals and OCSP stapling configuration. Alternatively, implement web application firewall rules to inspect and rate-limit OCSP-related traffic to mod_md endpoints, though this provides incomplete protection against sophisticated resource exhaustion attacks. Monitor server memory usage and configure resource limits (ulimit, cgroups) as defense-in-depth, recognizing these may only slow exploitation rather than prevent it.