Critical Vulnerability in Apache HTTP Server (httpd): Arbitrary Code Execution Risk
Summary
ALSA-2026:64794: Low: httpd:2.4 security update. Affects httpd versions < 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10. Fixed in 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely-used open-source web server software that enables the hosting of websites and web applications. Known for its robustness and flexibility, httpd supports various modules that extend its functionality, including mod_ldap for LDAP directory services. However, vulnerabilities can arise in its modules, leading to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-29167 is a use-after-free issue in the mod_ldap module of the Apache HTTP Server. This flaw allows an attacker to execute arbitrary code or cause a denial of service by manipulating per-directory configurations. The vulnerability stems from improper handling of memory, which can be exploited if an attacker can influence the server's configuration. The ramifications of this vulnerability are severe, as it could lead to unauthorized access to sensitive data or complete server compromise.
How To Fix
Minimum fixed version
2.4.37-65.module_el8.10.0+4270+e5f13fdb.10
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the mod_ldap module if it is not essential for your application. This can be done by commenting out the LoadModule directive in the Apache configuration file, typically located at /etc/httpd/conf/httpd.conf. For example:
LoadModule ldap_module modules/mod_ldap.so
After making changes, restart the Apache server using:
sudo systemctl restart httpd
Conclusion
The Apache HTTP Server vulnerability CVE-2026-29167 poses significant risks, including arbitrary code execution and denial of service. It is crucial to update affected packages to their patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for httpd →
FAQ
CVE-2026-29167 is a vulnerability in the Apache HTTP Server's mod_ldap module that allows for arbitrary code execution or denial of service due to a use-after-free error.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
The risks include unauthorized access to sensitive data, potential server compromise, and service disruptions due to denial of service attacks.
Yes, a patch is available. Updating to version 2.4.37-65.module_el8.10.0+4270+e5f13fdb.10 or later will resolve the vulnerability.
If immediate updating is not possible, consider disabling the mod_ldap module as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
