CVE-2026-29169
High · 7.5CVSS
7.5
EPSS
1.6%
Published
May 4, 2026
CISA due date
—
The record
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.66-160000.2.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.67-1.1 |
Related vulnerabilities
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2
- CVE-2026-33007 A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and… Also affects apache2
- CVE-2026-33523 HTTP response splitting vulnerability in multiple Apache HTTP Server modules with… Also affects apache2
- CVE-2026-23918 Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. Also affects apache2
- CVE-2026-33006 A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of… Also affects apache2
- CVE-2026-33857 Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-34032 Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. Also affects apache2