Skip to main content

Apache HTTP Server CVE-2026-29167

| EUVDEUVD-2026-35086 CRITICAL
Use After Free (CWE-416)
2026-06-08 apache GHSA-85f4-9pxx-739j
Denial Of Service Apache Use After Free Memory Corruption Red Hat Apache Http Server Apache Software Foundation
Critical
Disputed · 9.8 Vendor: apache
Share

Severity by source

Sources disagree (Low–Critical)
Vendor (apache) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
5.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Red Hat
4.6 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 09, 2026 - 16:30 vuln.today
CVSS changed
Jun 09, 2026 - 14:22 NVD
9.8 (CRITICAL)
CVE Published
Jun 08, 2026 - 15:07 nvd
CRITICAL 9.8
CVE Published
Jun 08, 2026 - 15:07 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

AnalysisAI

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition in mod_ldap when LDAP authentication or authorization is configured in a per-directory context. The CVSS 9.8 rating reflects unauthenticated network exploitation with high impact across confidentiality, integrity, and availability, though no public exploit has been identified at time of analysis and EPSS exploitation probability remains very low at 0.02%. CISA SSVC assesses exploitation status as none but flags the issue as automatable with total technical impact.

Technical ContextAI

Apache HTTP Server (httpd) is the world's most widely deployed open-source web server, and mod_ldap provides LDAP connection pooling and caching used by authentication modules such as mod_authnz_ldap. The flaw is classified as CWE-416 (Use After Free), a memory-safety defect where the server continues to reference an LDAP-related object after it has been freed, typically when LDAP directives are evaluated inside per-directory configuration (<Directory>, <Location>, or .htaccess scopes). Per-directory evaluation re-runs configuration merging on each request, which appears to create a lifecycle mismatch where an LDAP structure is released while still reachable, allowing an attacker to manipulate freed memory contents. The CPE confirms the affected product as Apache Software Foundation's apache_http_server across all platforms.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade httpd to 2.4.68 or later, per the Apache advisory at https://httpd.apache.org/security/vulnerabilities_24.html. Where an immediate upgrade is not feasible, an effective compensating control is to remove mod_ldap from the loaded modules (comment out the LoadModule ldap_module and LoadModule authnz_ldap_module directives) or relocate all LDAP-related directives (AuthLDAPURL, Require ldap-*, AuthLDAPBindDN, etc.) from per-directory scopes (<Directory>, <Location>, .htaccess) into the main server or virtual-host scope, which avoids the per-request re-evaluation path that triggers the use-after-free; the trade-off is loss of LDAP-backed authentication on the affected paths or loss of granular per-directory LDAP policy. As an additional layer, restrict network reachability of LDAP-protected URLs to trusted networks via firewall or mod_authz_host rules until the upgrade is applied. Additional references for tracking: https://seclists.org/oss-sec/2026/q2/833 and https://vuldb.com/vuln/369198.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t
CVE-2026-44185 HIGH
7.3 Jun 08

Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limi

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-29167 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy