Critical Vulnerability in httpd Package: Arbitrary Code Execution Risk
Summary
ALSA-2026:60004: Low: httpd security update. Affects httpd versions < 2.4.63-13.el10_2.6. Fixed in 2.4.63-13.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd package provides the Apache HTTP Server, a widely used web server known for its efficiency and extensibility. It supports various modules and configurations, making it a popular choice for hosting websites. However, it has recently been identified that a vulnerability exists within the mod_ldap module, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-29167, arises from a use-after-free error in the mod_ldap module's per-directory configuration. This flaw can allow an attacker to execute arbitrary code or cause a denial of service, potentially compromising the server's integrity and availability. The issue stems from improper memory management, which can be exploited under specific conditions, leading to significant security breaches.
How To Fix
Minimum fixed version
2.4.63-13.el10_2.6
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the mod_ldap module in their Apache configuration until the package is updated. This can be done by commenting out the LoadModule directive for mod_ldap in the httpd.conf file: '# LoadModule ldap_module modules/mod_ldap.so'. However, this may affect any LDAP functionalities currently in use.
Conclusion
The vulnerability in the httpd package, specifically in the mod_ldap module, poses significant risks including arbitrary code execution and denial of service. It is crucial for users to update to the patched version to safeguard their servers. Temporary workarounds can be employed, but a permanent fix through updates is highly recommended.
See every vulnerability recorded for httpd →
FAQ
CVE-2026-29167 is a vulnerability in the Apache HTTP Server's mod_ldap module that can lead to arbitrary code execution or denial of service due to a use-after-free error.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in your software without requiring installation.
If immediate updates are not possible, consider disabling the mod_ldap module as a temporary workaround to mitigate the risk until the update can be applied.
The vulnerability can lead to unauthorized code execution, allowing attackers to gain control over the server, or cause denial of service, making the server unavailable to legitimate users.
More details can be found on the CVE page for CVE-2026-29167, which provides in-depth information about the vulnerability, its impact, and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
