CVE-2026-29167: Apache HTTP Server Use After Free Flaw

CVE-2026-29167 Overview

CVE-2026-29167 is a use-after-free vulnerability [CWE-416] in the Apache HTTP Server mod_ldap module when LDAP directives appear in per-directory configuration. The flaw affects Apache HTTP Server versions 2.4.0 through 2.4.67. A remote attacker can trigger the condition over the network without authentication or user interaction. The Apache HTTP Server Project released version 2.4.68 to address the issue.

Critical Impact
Remote unauthenticated attackers can reach freed memory in mod_ldap, enabling potential code execution, memory disclosure, or worker process crashes that disrupt availability of any virtual host using LDAP-backed authentication or authorization.

Affected Products

Apache HTTP Server 2.4.0 through 2.4.67 with mod_ldap enabled
Web servers using mod_ldap directives in .htaccess or <Directory> blocks
Reverse proxies and application gateways that authenticate users against LDAP via Apache

Discovery Timeline

2026-06-08 - CVE-2026-29167 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-29167

Vulnerability Analysis

The Apache mod_ldap module provides LDAP connection pooling and result caching for other modules such as mod_authnz_ldap. When LDAP directives are placed in per-directory configuration contexts, the module mishandles the lifetime of an internal object. A pointer continues to reference memory after the backing allocation has been released. Subsequent requests that traverse the same per-directory configuration reach the freed region, producing a use-after-free [CWE-416].

Network-reachable exploitation does not require credentials or user interaction. The condition triggers during normal request processing against any URI governed by the affected per-directory block. Depending on the allocator state, the consequence ranges from worker crashes to controlled memory reuse that can be steered toward code execution.

Root Cause

The defect stems from incorrect object lifetime tracking inside mod_ldap when configuration is merged at per-directory scope. The module frees a structure while another code path retains and later dereferences the same pointer.

Attack Vector

An attacker sends HTTP requests to a path protected by mod_ldap directives in a <Directory>, <Location>, or .htaccess context. Repeated requests force the vulnerable code path and reach the freed allocation. Because authentication occurs after the vulnerable handling, no valid credentials are needed.

No public proof-of-concept is currently listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. Refer to the
Apache HTTP Server security advisory for technical detail:
https://httpd.apache.org/security/vulnerabilities_24.html

Detection Methods for CVE-2026-29167

Indicators of Compromise

Unexpected SIGSEGV or SIGABRT terminations of httpd worker processes recorded in error_log or system journal
Core dumps from httpd referencing mod_ldap.so frames or LDAP connection pool symbols
Spikes of child pid ... exit signal Segmentation fault messages tied to URIs that use LDAP authentication
Anomalous request bursts to LDAP-protected paths from a single source preceding worker crashes

Detection Strategies

Inventory all Apache servers and identify those loading mod_ldap with LoadModule ldap_module and directives such as AuthLDAPURL inside per-directory contexts
Match installed httpd package versions against 2.4.0 through 2.4.67 using configuration management or vulnerability scanners
Correlate web access logs with worker crash events to flag URIs that consistently precede process termination

Monitoring Recommendations

Forward httpderror_log, mod_ldap debug output, and OS-level crash telemetry to a centralized logging platform
Alert on repeated MPM child process restarts and on unusual rates of 500-class responses from LDAP-protected paths
Monitor outbound LDAP connection counts for abrupt churn that can indicate pool corruption

How to Mitigate CVE-2026-29167

Immediate Actions Required

Upgrade Apache HTTP Server to version 2.4.68 on every host that loads mod_ldap
Inventory .htaccess files and <Directory>, <Location>, and <Files> blocks for LDAP directives until the upgrade is complete
Restrict network exposure of LDAP-protected endpoints to trusted sources where business requirements allow
Restart httpd after patching to ensure the vulnerable module image is unloaded from memory

Patch Information

The Apache HTTP Server Project fixed the issue in version 2.4.68. Refer to the Apache HTTP Server Security Vulnerabilities advisory for the authoritative fix reference. Distribution maintainers typically publish backported packages; verify the installed package version after applying vendor updates.

Workarounds

Move LDAP directives from per-directory configuration into the main server or virtual host scope where feasible, since the flaw is specific to per-directory handling
Disable mod_ldap with a2dismod ldap (or equivalent) on servers that do not require LDAP-backed authentication
Place a hardened reverse proxy or web application firewall in front of LDAP-protected paths to filter abusive request patterns until patching completes

bash

# Verify installed version and patch status
httpd -v
apachectl -M | grep -i ldap

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade apache2
sudo systemctl restart apache2

# RHEL/Alma/Rocky
sudo dnf update httpd mod_ldap
sudo systemctl restart httpd

# Disable mod_ldap if not required
sudo a2dismod ldap authnz_ldap && sudo systemctl restart apache2