https://seclists.org/oss-sec/2026/q4/12: CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service
Published Oct 1, 2026
·Updated
Affected Software
1 affected component
Apache HTTP Server>=2.4.0<=2.4.68
Frequently Asked Questions
1
Which deployments are exposed to this issue?
Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_heartmonitor is used with a unicast listener. The issue is described as a NULL pointer dereference denial of service.
2
What version contains the fix?
Apache HTTP Server 2.4.69 includes the fix. The fix was made in the 2.4.x branch on 2026-10-01 in revision r1938654.