Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache HTTP Server WebDAV lock can cause crash
published 4 months ago
Summary
The Apache web server's WebDAV feature may crash when a specially crafted lock refresh request is sent to a resource that only inherits an indirect lock. This could stop the server from responding to web requests. Apply the latest security update from your distribution to fix the issue.
What to do
- Update canonical apache2 to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-bin to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-data to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-dev to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-doc to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-ssl-dev to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-suexec-custom to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-suexec-pristine to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical apache2-utils to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical libapache2-mod-md to version 2.4.41-4ubuntu3.23+tuxcare.els8.
- Update canonical libapache2-mod-proxy-uwsgi to version 2.4.41-4ubuntu3.23+tuxcare.els8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:20.04 | canonical | apache2 |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-bin |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-data |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-dev |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-doc |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-ssl-dev |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-suexec-custom |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-suexec-pristine |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | apache2-utils |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | libapache2-mod-md |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
| TuxCare:Ubuntu:20.04 | canonical | libapache2-mod-proxy-uwsgi |
< 2.4.41-4ubuntu3.23+tuxcare.els8 Fix: upgrade to 2.4.41-4ubuntu3.23+tuxcare.els8
|
Original advisory text
Fix CVE(s): CVE-2026-29169
* SECURITY UPDATE: NULL pointer dereference in mod_dav_lock indirect-lock
refresh
- debian/patches/CVE-2026-29169.patch: replace all six dp-> reads in
the indirect-lock branch of dav_generic_refresh_locks() with the
resolved dp_scan->... values in modules/dav/lock/locks.c so a crafted
WebDAV LOCK refresh against a resource that only inherits an indirect
lock from a parent no longer dereferences NULL via dp->locktoken /
dp->f.scope / dp->owner. Upstream fix
225dc070adba11040b774cf641e1d8bc79941643 (SVN r1933354).
- CVE-2026-29169
refresh
- debian/patches/CVE-2026-29169.patch: replace all six dp-> reads in
the indirect-lock branch of dav_generic_refresh_locks() with the
resolved dp_scan->... values in modules/dav/lock/locks.c so a crafted
WebDAV LOCK refresh against a resource that only inherits an indirect
lock from a parent no longer dereferences NULL via dp->locktoken /
dp->f.scope / dp->owner. Upstream fix
225dc070adba11040b774cf641e1d8bc79941643 (SVN r1933354).
- CVE-2026-29169
References
- https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1782159571.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-29169 Vendor Advisory
Timeline
Published22 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1782159571 · OSV
Track software like this
Free during beta