Description
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.



This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published: 2026-10-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A NULL pointer dereference, identified as CWE-476, has been discovered in the mod_heartmonitor module of Apache HTTP Server. The flaw is triggered when the unicast listener processes malformed or crafted traffic, causing the server process to crash and become unavailable. The impact is a denial of service that can affect the entire HTTP service without providing any other system compromise.

Affected Systems

Apache HTTP Server versions from 2.4.0 to 2.4.68, inclusive, are impacted. The vulnerability exists in the core mod_heartmonitor module used by these releases.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, but the EPSS score is unavailable. The vulnerability permits a simple network-based attack that can be executed by sending a crafted packet to the unicast listener. The flaw has not been listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Nevertheless, the potential for service disruption warrants immediate attention.

Generated by OpenCVE AI on October 1, 2026 at 19:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.69 or later where the mod_heartmonitor issue is fixed.
  • If the module is not required, disable or remove mod_heartmonitor from the server configuration.
  • Restrict network access to the unicast listener using firewall rules to limit connections to trusted hosts.

Generated by OpenCVE AI on October 1, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6569-1 apache2 security update
History

Fri, 02 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Vendors & Products Apache
Apache http Server

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache Software Foundation
Apache Software Foundation apache Http Server
Vendors & Products Apache Software Foundation
Apache Software Foundation apache Http Server

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Title Apache HTTP Server: mod_heartmonitor denial of service
Weaknesses CWE-476
References

Subscriptions

Apache Http Server
Apache Software Foundation Apache Http Server
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T20:09:19.923Z

Reserved: 2026-05-17T14:18:39.243Z

Link: CVE-2026-46729

cve-icon Vulnrichment

Updated: 2026-10-01T20:09:19.923Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T16:17:44.293

Modified: 2026-10-08T00:47:12.233

Link: CVE-2026-46729

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-01T15:55:27Z

Links: CVE-2026-46729 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T19:45:03Z

Weaknesses