PT-2026-36812 · Apache+4 · Apache Http Server+4

Pavel Kohout · CVE-2026-29169 · Published 2026-03-04 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.66

Description A NULL pointer dereference in the mod dav lock module may allow an attacker to crash the server by sending a malicious request. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to an application crash.

Recommendations Upgrade to version 2.4.66. Remove the mod dav lock module.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2026:34109

ALSA-2026:41906

ALSA-2026:42828

BDU:2026-06309

BIT-APACHE-2026-29169

CVE-2026-29169

OESA-2026-2316

OESA-2026-2318

OESA-2026-2319

OESA-2026-2320

OESA-2026-2401

OPENSUSE-SU-2026:10785-1

OPENSUSE-SU-2026:21115-1

RHSA-2026:17080

RHSA-2026:27200

RHSA-2026:34109

SUSE-SU-2026:22199-1

SUSE-SU-2026:22209-1

SUSE-SU-2026:2641-1

SUSE-SU-2026:2686-1

USN-8239-1

USN-8396-1

Affected Products

Apache Http Server

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 203

• https://osv.dev/vulnerability/OESA-2026-2318 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22199-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-29169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29169 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:42828 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-29169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34059 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:41906 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8239-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22209-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-29169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24072 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33523 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2686-1 · Vendor Advisory