CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service
Apache HTTP Server: modheartmonitor denial of service
Other sources
NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1
Event History
Frequently Asked Questions
Which Apache HTTP Server deployments are affected?
Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_heartmonitor is used with a unicast listener.
What condition is required to exploit this issue?
The vulnerability is in mod_heartmonitor's handling of a unicast listener. The provided information does not identify any further attacker prerequisites or required request characteristics.
What is the impact of successful exploitation?
Successful exploitation can trigger a NULL pointer dereference, resulting in denial of service.