PT-2026-37663 · Bitnami · Apache

Publicado 2026-05-06 · Atualizado 2026-05-06

OSV

A NULL pointer dereference in mod dav lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod dav lock is not used internally by mod dav or mod dav fs.

The only known use-case for mod dav lock was mod dav svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod dav lock.

Identificadores relacionados

BIT-APACHE-2026-29169

Produtos afetados

Apache

Referências · 5

• http://openwall.com/lists/oss-security/2026/05/05/12 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-29169 · Nota de Segurança
• http://openwall.com/lists/oss-security/2026/05/04/20 · Nota
• https://httpd.apache.org/security/vulnerabilities_24.html · Nota
• https://osv.dev/vulnerability/BIT-apache-2026-29169 · Aviso do Fabricante