[Kanishk Bansal (Kanishk-Bansal)]

Summary

Backport the fix for CVE-2026-106023 to mod_md 2.6.11 as a patch overlay. The release goes from 2.6.11-3 to 2.6.11-4.

CVE-2026-106023 (important) is a NULL pointer dereference: a request without a Host header (HTTP/1.0) to the ACME challenge or certificate status handlers crashes the child process. It was fixed in httpd 2.4.71 by 1b47e95c.

There is no other way to get the fix:

• The standalone icing/mod_md project was archived in June 2026, and 2.6.11 is its last release.
• Fedora has not patched mod_md in any branch yet.
• httpd builds with --disable-md, so the httpd 2.4.71 upgrade (fix(httpd): upgrade to 2.4.71 to address CVE-2026-109163 #20164) does not cover it.

The patch is the upstream change with paths moved from modules/md/ to src/. It adds NULL host checks in md_get_by_domain(), md_http_challenge_pr() and md_http_cert_status().

The CVE is not in Astrolabe yet, so there is nothing to claim.

Related: httpd 2.4.71 in #20164, mod_http2 in #20165.

Changes

• base/comps/components.toml: drop the inline mod_md entry
• base/comps/mod_md/mod_md.comp.toml: new, no pin change (still f43 a463975c0f89)
• base/comps/mod_md/overlays/0001-CVE-2026-106023.overlay.toml + patch
• locks/mod_md.lock, specs/m/mod_md/: refreshed and re-rendered

Testing

• Local mock build: the patch applies with --fuzz=0 after Fedora's CVE-2026-29168 patch; rpmautospec on the synthetic dist-git gives release 4
• Smoke test in mock with an MDomain configured: HTTP/1.0 requests with no Host to /.well-known/acme-challenge/x and /.httpd/certificate-status return 404 and 403, normal requests still work, no crashes in error_log
• azldev comp update --check-only -p mod_md is clean

[Kanishk Bansal (Kanishk-Bansal)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

🟡 Changes recommended

The overlay incorrectly uses upstreamed despite Fedora not yet carrying the fix; it should use upstreamable to record the correct backport-retirement condition.

1 open issue

• Use upstreamable for fixes not yet present in Fedora · New

What changed in this PR

Backports the CVE-2026-106023 fix to standalone mod_md 2.6.11, preventing crashes on requests without a Host header. This complements the httpd upgrade, which does not ship the module.

Changes:

• Adds NULL hostname checks to domain lookup and the ACME challenge and certificate status handlers.
• Moves mod_md into a dedicated component definition with a backport overlay, preserving the upstream pin.
• Refreshes the lock and rendered files, increasing the package release from 3 to 4.

File	Description
specs/​m/​mod_md/​mod_md.spec	Registers the patch and updates the release and changelog.
specs/​m/​mod_md/​mod_md-2.6.11-CVE-2026-106023.patch	Includes the rendered security patch for packaging.
locks/​mod_md.lock	Refreshes the component input fingerprint.
base/​comps/​mod_md/​overlays/​0001-CVE-2026-106023.overlay.toml	Applies the backport and records its provenance.
base/​comps/​mod_md/​mod_md.comp.toml	Defines the component separately to support its overlay.
base/​comps/​mod_md/​mod_md-2.6.11-CVE-2026-106023.patch	Adds the three NULL checks using standalone source paths.
base/​comps/​components.toml	Removes the former inline component entry.

_{Review effort: Balanced}