AI analysis
Apache HTTP Server 2.4.0 through 2.4.68 has a NULL pointer dereference (CWE-476) in mod_heartmonitor when that module uses a unicast listener. A remote attacker can trigger it over the network without authentication, privileges, or user interaction, and with low attack complexity. The crash affects availability only: CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impact. Installations in that version range that load mod_heartmonitor and expose the unicast listener are affected; servers that do not enable the module are not reachable through this flaw. No public proof-of-concept is known and the issue is not on the CISA KEV list.
What to do: Upgrade Apache HTTP Server to a release newer than 2.4.68 once one is available; the advisory data does not name a fixed version. Until then, unload mod_heartmonitor if it is not required (httpd -M) and do not expose its unicast listener beyond trusted cluster peers. Investigate unexpected worker crashes on heartmonitor-enabled servers as a possible sign of this issue.
Affected
| Apache Software Foundation HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
largemillions of Apache httpd 2.4 installs in the affected range; exploitable unicast mod_heartmonitor listeners are a smaller, uncounted subset — Public web surveys have long counted Apache HTTP Server on a large share of sites, implying millions of 2.4 installs, but mod_heartmonitor is an optional clustering module that is not enabled by default and no public scan count of unicast…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.