CVE-2026-29169

published 2026-05-04

CVE-2026-29169: A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.

The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	< 2.4.67	2.4.67
apache	httpd	—	—
apache_software_foundation	apache_http_server	<= 2.4.66	—
httpd_2.4	httpd	—	—
ubuntu	apache2	—	—

CWE-476