Apache HTTP Server EUVD-2026-90887

Exploitation requires that the target run mod_heartmonitor configured to use a unicast listener (the HeartbeatListen/unicast mode associated with Apache's heartbeat/mod_cluster-style load-balancer monitoring). This module is not part of a default Apache HTTP Server install and must be explicitly loaded and configured, which substantially limits the exposed population. Where enabled and network-reachable, the CVSS vector indicates no authentication or user interaction is needed (PR:N/UI:N) and low attack complexity (AC:L). The limiting factors are therefore configuration-based (non-default module + unicast listener exposure) and impact-based (availability only - a crash/DoS, with no data disclosure or code execution); versions 2.4.0 through 2.4.68 are affected.

Signals are consistent and point to a moderate-priority availability issue rather than an urgent threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated denial of service with no confidentiality or integrity impact - the 'High' score is driven entirely by availability. CISA's SSVC framework reinforces a measured posture: Exploitation is rated 'none' (no observed or public exploitation), while 'Automatable: yes' and 'Technical Impact: partial' indicate that if an exploit emerged it could be scripted but would only cause partial impact (a crash/DoS, not full compromise). This is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The critical caveat the raw CVSS score hides: the flaw is in mod_heartmonitor operating over a unicast listener, which is a non-default, specialized module typically used in mod_cluster/heartbeat load-balancing topologies - so the PR:N/AV:N 'unauthenticated network' framing only holds for the subset of deployments that have explicitly enabled and exposed this module. Net assessment: a genuine but situational availability bug; high CVSS, but real-world risk is bounded to a narrow configuration and limited to DoS.

An attacker able to reach a server where mod_heartmonitor is configured with a unicast listener sends a crafted heartbeat message that triggers a NULL pointer dereference in the module. The affected httpd process crashes, producing a denial of service against the monitoring/load-balancing path. No public exploit code is referenced, and CVSS AC:L suggests that once the module is exposed, triggering the condition is not technically difficult.