NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Fix
Microsoft's update · Important
- Release Notes — azl3 httpd 2.4.68-1 on Azure Linux 3.0 · build 2.4.69-1
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-29.
Patch, vendor advisory and mitigation references on NVD 1
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · apacheNVD modified 2026-10-08 00:47
Affected (CPE criteria) 1
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
References 2
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/01/13 Mailing List, Third Party Advisory