CVE-2026-46729

A flaw was found in the mod_heartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attacker can crash the server process, resulting in a Denial of Service (DoS).

Red Hat has rated this flaw as having an Important severity because unauthenticated network clients can crash the HTTP server process without user interaction, causing a complete denial of service. Under standard installations across Red Hat Enterprise Linux, mod_heartmonitor is not enabled by default and requires administrators to explicitly load the module and configure a unicast listener. Systems that do not use mod_heartmonitor or do not expose its listener to untrusted networks are not vulnerable to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the mod_heartmonitor module or restrict network access to the monitoring port:

1. Disable the module: Comment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in /etc/httpd/conf.modules.d/00-base.conf or a custom configuration file):

LoadModule heartmonitor_module modules/mod_heartmonitor.so

Then reload the web server configuration: systemctl reload httpd

2. Restrict network reachability: If mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes: firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE> firewall-cmd --reload

Caveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing.

Warning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections.