Apache HTTP Server CVE-2026-29169

Exploitation requires Apache HTTP Server to be configured with mod_dav_lock loaded and enabled via LoadModule directive in httpd.conf or equivalent configuration files. Since mod_dav_lock is not used by core mod_dav or mod_dav_fs modules and its only documented use-case was supporting Apache Subversion versions earlier than 1.2.0 (2005), this module is rarely enabled in modern deployments. Servers not explicitly loading mod_dav_lock are immune regardless of Apache version. Exploitation limits include: network access to the Apache server on WebDAV-enabled virtual hosts, but no authentication, user interaction, or non-default settings are required if the module is loaded. The specific configuration of Subversion or other WebDAV clients does not affect vulnerability - only server-side mod_dav_lock presence matters.

Real-world risk is moderate despite the CVSS 7.5 (High) score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with low complexity, and SSVC confirms the attack is automatable. However, SSVC exploitation status is 'none', indicating no confirmed active exploitation, and the technical impact is partial (availability only). The critical limiting factor is that mod_dav_lock must be loaded and enabled - a configuration likely present only in legacy systems supporting very old Subversion installations (pre-2005). Modern Apache deployments do not typically load this module, significantly reducing the attack surface. The availability of both a patch (2.4.66) and a simple remediation (module removal) further lowers practical risk. Organizations should prioritize assessment based on whether mod_dav_lock is actually enabled in their environment rather than treating this as a universal high-priority issue.

An unauthenticated remote attacker identifies an Apache HTTP Server with mod_dav_lock enabled through service fingerprinting or configuration reconnaissance. The attacker crafts a malicious WebDAV request targeting the mod_dav_lock module's lock handling logic, triggering the NULL pointer dereference. The Apache worker process crashes immediately, causing service disruption for users connected to that process or, with repeated exploitation, sustained denial of service across the server. No public exploit code has been identified, but the low attack complexity suggests exploit development would be straightforward for attackers with WebDAV protocol knowledge.