Skip to main content

Apache HTTP Server CVE-2026-29167

| EUVDEUVD-2026-35086 CRITICAL
Use After Free (CWE-416)
2026-06-08 apache GHSA-85f4-9pxx-739j
Denial Of Service Apache Use After Free Memory Corruption Red Hat Apache Http Server Apache Software Foundation
Critical
Disputed · 9.8 Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify httpd target with LDAP-protected path
  2. Delivery
    Send crafted request to per-directory LDAP scope
  3. Exploit
    Trigger use-after-free in mod_ldap
  4. Install
    Groom heap via repeated requests
  5. C2
    Corrupt freed LDAP structure
  6. Execute
    Hijack control flow in worker process
  7. Impact
    Execute code as httpd user

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Target Apache HTTP Server 2.4.0-2.4.67 must have mod_ldap loaded AND at least one LDAP-related directive (e.g., AuthLDAPURL, Require ldap-user/ldap-group, AuthLDAPBindDN) declared within a per-directory configuration context - <Directory>, <Location>, <Files>, or an .htaccess file - rather than at the main server or virtual-host scope. The attacker must be able to reach the protected URL over the network (CVSS AV:N) and requires no authentication or user interaction (PR:N/UI:N), but the per-directory mod_ldap configuration is not a default httpd setup, which materially limits the exposed population to sites using LDAP-backed authentication with granular per-path policy. Stock Apache installations without mod_ldap or with LDAP configured only at server scope are not exploitable.
Impact

Signals here are unusually mixed and warrant caution. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N suggests trivial remote unauthenticated compromise, and SSVC marks the bug as automatable with total technical impact, which would normally drive urgent action. However, EPSS sits at 0.02% (4th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis - patterns consistent with a freshly disclosed memory-corruption issue that is theoretically severe but not yet weaponized. A key qualifier the raw CVSS hides: exploitation requires mod_ldap to be active and configured per-directory, which is not a default httpd configuration, so internet-wide exposure is narrower than the score implies. Given Apache HTTP Server's ubiquity and the automatable+total-impact SSVC verdict, treat this as a high-priority patch for any host where mod_ldap is loaded, but as routine patching for stock httpd deployments without LDAP auth.
Exploit ScenarioDerived

An attacker sends a sequence of crafted HTTP requests to a URL protected by an LDAP Require/Auth directive declared inside a <Directory> or <Location> block, triggering repeated per-directory config evaluation that frees and re-references an LDAP structure. By controlling request timing and content to influence what occupies the freed memory, the attacker corrupts internal state to crash the worker (denial of service) or potentially redirect execution for code execution as the httpd user. No public exploit has been identified at time of analysis, but SSVC marks the issue as automatable, meaning scanning and mass-trigger tooling could plausibly emerge.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 09, 2026

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition in mod_ldap when LDAP authentication or authorization is configured in a per-directory context. The CVSS 9.8 rating reflects unauthenticated network exploitation with high impact across confidentiality, integrity, and availability, though no public exploit has been identified at time of analysis and EPSS exploitation probability remains very low at 0.02%. CISA SSVC assesses exploitation status as none but flags the issue as automatable with total technical impact.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade httpd to 2.4.68 or later, per the Apache advisory at https://httpd.apache.org/security/vulnerabilities_24.html. Where an immediate upgrade is not feasible, an effective compensating control is to remove mod_ldap from the loaded modules (comment out the LoadModule ldap_module and LoadModule authnz_ldap_module directives) or relocate all LDAP-related directives (AuthLDAPURL, Require ldap-*, AuthLDAPBindDN, etc.) from per-directory scopes (<Directory>, <Location>, .htaccess) into the main server or virtual-host scope, which avoids the per-request re-evaluation path that triggers the use-after-free; the trade-off is loss of LDAP-backed authentication on the affected paths or loss of granular per-directory LDAP policy. As an additional layer, restrict network reachability of LDAP-protected URLs to trusted networks via firewall or mod_authz_host rules until the upgrade is applied. Additional references for tracking: https://seclists.org/oss-sec/2026/q2/833 and https://vuldb.com/vuln/369198.

Affected VersionsENISA

Apache HTTP Server 2.4.0 ≤2.4.67

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache HTTP Server (httpd) is the world's most widely deployed open-source web server, and mod_ldap provides LDAP connection pooling and caching used by authentication modules such as mod_authnz_ldap. The flaw is classified as CWE-416 (Use After Free), a memory-safety defect where the server continues to reference an LDAP-related object after it has been freed, typically when LDAP directives are evaluated inside per-directory configuration (<Directory>, <Location>, or .htaccess scopes). Per-directory evaluation re-runs configuration merging on each request, which appears to create a lifecycle mismatch where an LDAP structure is released while still reachable, allowing an attacker to manipulate freed memory contents. The CPE confirms the affected product as Apache Software Foundation's apache_http_server across all platforms.

Know when Apache Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)
Vendor (apache) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE 5.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Red Hat 4.6 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Jun 09, 2026 - 14:22 NVD
9.8 (CRITICAL)
CVE Published
Jun 08, 2026 - 15:07 nvd
CRITICAL 9.8
CVE Published
Jun 08, 2026 - 15:07 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Executive ViewAI

Why It Matters

Apache HTTP Server versions 2.4.0-2.4.67 contain a critical remote code execution vulnerability in mod_ldap that allows unauthenticated attackers to execute arbitrary code on systems using LDAP-based authentication. Organizations relying on these versions for identity-critical services face immediate risk of account compromise and system takeover, with no vendor patch currently available. Immediate containment actions are required for any deployment using mod_ldap with per-directory LDAP authentication or authorization.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable mod_ldap module if LDAP authentication is not required; (2) Restrict network access to affected Apache servers via firewall/network segmentation; (3) Deploy Web Application Firewall rules targeting mod_ldap exploitation attempts; (4) Implement redundant authentication layers (e.g., reverse proxy with separate auth); (5) Enable continuous monitoring and alerting for suspicious authentication failures or process execution anomalies on affected hosts.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-93546 HIGH
8.8 Oct 01

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client

CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-63292 HIGH
7.5 Oct 01

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
CVE-2026-59685 HIGH
7.5 Oct 01

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:25042 ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-29167 ADVISORY https://seclists.org/oss-sec/2026/q2/833 ADVISORY https://ubuntu.com/security/notices/USN-8516-1 ADVISORY https://vuldb.com/vuln/369198 REF http://www.openwall.com/lists/oss-security/2026/06/08/4 REF http://www.openwall.com/lists/oss-security/2026/06/09/1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy