VDB
ALPINE-CVE-2026-29169
ALPINE-CVE-2026-29169
PUBLISHED
CVSS 7.5 HIGH
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | apache2 | 2.4.29-r0, 2.4.3-r0, 2.4.3-r1 |
| Alpine:v3.24 | apache2 | 0 |
| Alpine:v3.21 | apache2 | 2.4.23-r9, 2.4.23-r7, 2.4.23-r6 |
| Alpine:v3.20 | apache2 | 2.4.38-r0, 2.2.16-r0, 2.2.16-r1 |
| Alpine:v3.22 | apache2 | 2.4.49-r1, 2.4.50-r0, 2.4.51-r0 |
Timeline
- May 4, 2026 CVE Published
- May 5, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated