Skip to main content

Apache HTTP Server CVE-2026-29169

| EUVDEUVD-2026-26957 HIGH
NULL Pointer Dereference (CWE-476)
2026-05-04 apache
Denial Of Service Apache Null Pointer Dereference Red Hat Apache Http Server Apache HTTP Server Apache Software Foundation
High
Disputed · 7.5 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 04, 2026 - 17:22 vuln.today
CVSS changed
May 04, 2026 - 17:22 NVD
7.5 (None) 7.5 (HIGH)
EUVD ID Assigned
May 04, 2026 - 15:00 euvd
EUVD-2026-26957
Analysis Generated
May 04, 2026 - 15:00 vuln.today
CVE Published
May 04, 2026 - 14:48 nvd
HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.

AnalysisAI

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL pointer dereference in mod_dav_lock, causing denial of service. The vulnerability affects only servers with mod_dav_lock enabled, a legacy module whose primary use-case (Apache Subversion < 1.2.0) is obsolete in modern deployments. CISA SSVC indicates no active exploitation, but the attack is automatable against susceptible configurations. CVSS 7.5 (High) reflects network-accessible, unauthenticated denial of service, though real-world impact is limited to the small subset of servers still running mod_dav_lock.

Technical ContextAI

The vulnerability exists in mod_dav_lock, a locking provider module for WebDAV (Web Distributed Authoring and Versioning) in Apache HTTP Server. CWE-476 (NULL Pointer Dereference) occurs when the module attempts to access memory through a null pointer while processing specially crafted requests, causing the server process to crash. mod_dav_lock is distinct from the core mod_dav and mod_dav_fs modules, which do not use it internally. The module's original purpose was to support mod_dav_svn from Apache Subversion versions before 1.2.0 (released in 2005), making it largely obsolete in current infrastructure. CPE data identifies the affected product as Apache HTTP Server through version 2.4.66.

RemediationAI

Upgrade to Apache HTTP Server version 2.4.66 or later, which contains the fix for this NULL pointer dereference. For organizations unable to upgrade immediately, disable and remove mod_dav_lock from the Apache configuration by commenting out or removing the LoadModule directive for mod_dav_lock from httpd.conf or applicable configuration files, then restarting Apache. This mitigation has no functional impact on modern deployments since mod_dav_lock's use-case (Subversion < 1.2.0) is obsolete. Verify module removal by checking loaded modules with 'httpd -M' or 'apachectl -M' to confirm mod_dav_lock is not listed. Consult the official Apache security advisory at https://httpd.apache.org/security/vulnerabilities_24.html for additional guidance.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t
CVE-2026-44185 HIGH
7.3 Jun 08

Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limi

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-29169 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy