A NULL pointer dereference occurs in the mod_dav_lock module of Apache HTTP Server earlier than 2.4.66 when processing a malicious request, leading to a server crash. The flaw is triggered only when the module is loaded, and an attacker can cause an abrupt termination of the HTTP service, disrupting availability for clients. No maintenance or persistence beyond the crash is achieved, and an attacker cannot directly execute code.

All installations of Apache HTTP Server earlier than version 2.4.66 that load the optional mod_dav_lock module are vulnerable. This module was rarely used internally by Apache itself; outside use occurs in the mod_dav_svn plugin of Apache Subversion versions older than 1.2.0. Systems that do not enable mod_dav_lock or do not run an affected Subversion server are not impacted.

The vulnerability carries no known exploitation in the wild and is not listed in CISA's KEV catalog. EPSS data is unavailable, so the probability of exploitation cannot be quantified. However, because the flaw manifests only when the module is active, a remote attacker who can send crafted DAV requests to a vulnerable server could directly cause a denial of service by crashing the process. The CVSS score of 7.5 indicates a high severity level.