CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service
Apache discloses low-severity CVE-2026-46729, a mod_heartmonitor NULL dereference that can crash HTTP Server.
Eric Covener reported CVE-2026-46729, a NULL pointer dereference in Apache HTTP Server's mod_heartmonitor unicast listener. The flaw affects versions 2.4.0 through 2.4.68 and is rated low severity. It can crash the server and cause a denial of service. The oss-security post does not describe exploitation in the wild.
- CVE-2026-46729 is a NULL pointer dereference in mod_heartmonitor.
- Apache HTTP Server 2.4.0 through 2.4.68 is affected.
- The unicast heartmonitor listener is the vulnerable path.
- Apache rates the denial-of-service issue low severity.
Vulnerabilities mentionedAll →
- CVE-2026-467297.5—NULL pointer dereference DoS in Apache HTTP Server mod_heartmonitorpublished · Apache Software Foundation HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-46729 | NULL pointer dereference DoS in Apache HTTP Server mod_heartmonitor Apache HTTP Server 2.4.0 through 2.4.68 has a NULL pointer dereference (CWE-476) in mod_heartmonitor when that module uses a unicast listener. A remote attacker can trigger it over the network without authentication, privileges, or user interaction, and with low attack complexity. The crash affects availability only: CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impact. Installations in that version range that load mod_heartmonitor and expose the unicast listener are affected; servers that do not enable the module are not reachable through this flaw. No public proof-of-concept is known and the issue is not on the CISA KEV list. Upgrade Apache HTTP Server to a release newer than 2.4.68 once one is available; the advisory data does not name a fixed version. Until then, unload mod_heartmonitor if it is not required (httpd -M) and do not expose its unicast listener beyond trusted cluster peers. Investigate unexpected worker crashes on heartmonitor-enabled servers as a possible sign of this issue. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Credit: Zhang San (finder) Ankit Prateek (OffByQuant) (finder) Zhen Kong (finder) SeungHyun Cho of KISA (finder) 4ra1n, pyn3rd and unam4 (finder) Ryoma Nishioka (finder) Keita Sode...
This source does not provide full text. Read it at seclists.org.