NULL Pointer Dereference Vulnerability in Apache HTTP Server (mod_heartmonitor)
Summary
ALPINE-CVE-2026-46729: NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. Affects apache2 versions < 2.4.69-r0. Fixed in 2.4.69-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content. It is known for its flexibility, performance, and security features. The mod_heartmonitor module is designed to monitor the health of Apache servers. However, a NULL Pointer Dereference vulnerability has been identified, affecting versions from 2.4.0 to 2.4.68, which could lead to server crashes and potential denial of service.
Vulnerability Detail
The vulnerability arises from a NULL Pointer Dereference in the mod_heartmonitor module when handling unicast listeners. This flaw can be exploited by attackers to cause the Apache server to crash, resulting in a denial of service. The issue is particularly concerning as it affects a core component of the server, potentially impacting all hosted applications and services.
How To Fix
Minimum fixed version
2.4.69-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the mod_heartmonitor module temporarily to mitigate the risk of exploitation. This can be done by commenting out or removing the relevant configuration lines in the Apache configuration files.
Conclusion
The NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor poses a significant risk to server stability and availability. It is crucial for users to update to the latest version to mitigate this risk and ensure the continued security of their web applications.
See every vulnerability recorded for apache2 →
FAQ
A NULL Pointer Dereference vulnerability occurs when a program attempts to access memory that has not been allocated, leading to crashes or unpredictable behavior.
You can check your Apache version by running 'apache2 -v' in your terminal. If it is between 2.4.0 and 2.4.68, it is affected by this vulnerability.
Exploitation of this vulnerability can lead to server crashes, resulting in denial of service for users accessing the web applications hosted on the server.
Yes, tools like Vulert can help monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code.
You can find detailed information about this vulnerability in the CVE database under CVE-2026-46729.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
