PT-2026-36812 · Apache+2 · Apache Http Server+2

Pavel Kohout · Published 2026-03-04 · Updated 2026-05-22 · CVE-2026-29169

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.66

Description A NULL pointer dereference in the mod dav lock module may allow an attacker to crash the server by sending a malicious request. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to an application crash.

Recommendations Upgrade to version 2.4.66. Remove the mod dav lock module.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-06309

BIT-APACHE-2026-29169

CVE-2026-29169

OESA-2026-2316

OESA-2026-2318

OESA-2026-2319

OESA-2026-2320

OESA-2026-2401

OPENSUSE-SU-2026:10785-1

RHSA-2026:17080

USN-8239-1

Affected Products

Apache Http Server

Linuxmint

Ubuntu

References · 63

• https://ubuntu.com/security/CVE-2026-33006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24072 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2401 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28780 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33007 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-29169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33523 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-29169 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33857 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34059 · Security Note
• https://ubuntu.com/security/CVE-2026-23918 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8239-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2318 · Vendor Advisory