CVE-2026-29167

CriticalCVSS 9.8

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

48th percentile - higher than 48% of all known CVEs

Summary

Apache HTTP Server versions 2.4.0 through 2.4.67 have a Use After Free vulnerability in mod_ldap with per-directory configuration. This can lead to undefined behavior.

Risk Assessment

An attacker could exploit this vulnerability to cause server crashes or potentially remote code execution, threatening server availability and security.

Recommendation

Update Apache HTTP Server to version 2.4.68, which fixes the issue. Avoid using mod_ldap in per-directory configuration if possible.

Original NVD description (English source)

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.