Apache HTTP Server Integer Overflow Vulnerability in ACME Certificate Renewal Process

An integer overflow vulnerability has been identified in the Apache HTTP Server's mod_md module, specifically during the ACME certificate renewal process. This vulnerability is present in versions 2.4.30 prior to 2.4.66. The issue arises when the certificate renewal fails multiple times, leading to the backoff timer being set to zero. As a result, the server repeatedly attempts to renew the certificate without any delay, until the renewal succeeds.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by overwhelming the server with rapid, repeated certificate renewal attempts, bypassing the intended backoff mechanism.

Remediation

Users are advised to upgrade to Apache HTTP Server version 2.4.66, which addresses this vulnerability.