CVE-2026-29167

A flaw was found in Apache HTTP Server when using the mod_ldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service (DoS) due to improper memory handling. This could lead to system instability or unauthorized control over the affected server.

CISA's 9.8 is a mechanical worst-case UAF score. Their vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — they're treating it as: "network-facing service, memory corruption primitive, assume RCE." This is how CISA-ADP routinely scores any UAF in a network daemon. They don't analyze actual exploitability; they score the theoretical ceiling of the vulnerability class.

Apache's LOW reflects what actually happens.

1. Trigger is narrow — mod_ldap must be loaded (not default) AND configured in per-directory context (<Directory>, <Location>, .htaccess). Server-wide LDAP config doesn't trigger it. This is an unusual configuration pattern.
2. UAF in config merging, not request handling — the freed memory is in the per-directory configuration merge path, which constrains the timing window and what objects occupy the freed allocation. This isn't a heap spray-friendly UAF in a hot request path.
3. httpd's process model kills RCE reliability — prefork uses separate processes (crash = one child dies, parent respawns), worker/event have per-process address space. Turning a UAF into reliable RCE against httpd is substantially harder than against a single-threaded daemon with a predictable heap layout.
4. Realistic impact is DoS — the freed pointer will most likely cause a segfault (child crash), not a controlled write primitive. The parent process respawns workers, so even the DoS is transient.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

upgrade apache web server to 2.4.68