Critical Security Update for mod_md: CVE-2026-29168
Summary
RHSA-2026:57844: Red Hat Security Advisory: mod_md security update. Affects mod_md versions < 1:2.4.19-1.el9_4.2. Fixed in 1:2.4.19-1.el9_4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_md is an Apache module that automates the management of SSL/TLS certificates using the ACME protocol. It simplifies the process of obtaining and renewing certificates, ensuring secure communications for web applications. However, vulnerabilities in mod_md can expose systems to security risks, necessitating timely updates and patches.
Vulnerability Detail
The vulnerability identified as CVE-2026-29168 affects mod_md versions prior to 1:2.4.19-1.el9_4.2. This issue arises from improper handling of certain requests, which could allow an attacker to exploit the system, potentially leading to unauthorized access or denial of service. The CVSS score of this vulnerability is 7.5, indicating a high severity level that requires immediate attention.
How To Fix
Minimum fixed version
1:2.4.19-1.el9_4.2
This is the first release that contains the fix.
sudo dnf update mod_mdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the mod_md module by configuring your server settings to limit exposure until the update is applied. This can be done by modifying the Apache configuration files to disable mod_md or by applying strict access controls.
Conclusion
The mod_md package has a critical vulnerability (CVE-2026-29168) that requires immediate attention. Users are advised to update to the patched version to mitigate risks. Temporary workarounds can be applied until the update is completed.
See every vulnerability recorded for mod_md →
FAQ
CVE-2026-29168 is a security vulnerability in the mod_md package that can lead to unauthorized access or denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If you cannot update the package immediately, consider applying access restrictions to the mod_md module as a temporary workaround.
More information about mod_md can be found in the official Apache documentation and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for mod_md.
