Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache HTTP Server may crash or run malicious code via LDAP settings

published 2 months ago

Summary

The Apache web server’s LDAP module can be tricked into freeing memory too early, which could cause the server to stop working or allow an attacker to run their own code. This risk affects any system using the Apache HTTP Server with LDAP configuration. Apply the latest Apache update as soon as possible to prevent these problems.

What to do

Update rocky httpd to version 0:2.4.63-13.el10_2.6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:10	rocky	httpd	< 0:2.4.63-13.el10_2.6 Fix: upgrade to 0:2.4.63-13.el10_2.6

Original advisory text

Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:60004 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2486394 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:60004 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.6 Medium

Timeline

Published26 Aug 2026

Updated27 Aug 2026

First seen27 Aug 2026

Sources

RLSA-2026:60004 · OSV

Track software like this

Free during beta