Vulnerability intelligence

CVE-2026-29169

A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove mod_dav_lock.

CVSS Score

7.5

High

EPSS — Exploit Probability

0.6%

Riskier than 45% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered May 5, 2026 · latest May 5, 2026

Coverage timeline

Apache patches HTTP Server and MINA flaws, warns of RCE risk
www.securityweek.com · May 5, 2026