Search: CVE-2026-29169

CVE-2026-29169 is a high-severity vulnerability in Apache HTTP Server versions 2.4.66 and earlier involving a NULL pointer dereference in the mod_dav_lock module. This flaw may allow an attacker to crash the server by sending a malicious request. The mod_dav_lock module is not used internally by mod_dav or mod_dav_fs, and its primary known use was with mod_dav_svn from Apache Subversion versions earlier than 1.2.0. Users are advised to upgrade to Apache HTTP Server version 2.4.66 or later, or alternatively remove the mod_dav_lock module to mitigate the issue.