AZL-86019

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86019.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-86019

Upstream

CVE-2026-29169

Published

2026-05-04T15:16:03Z

Modified

2026-08-28T17:47:37.458560920Z

Summary

CVE-2026-29169 affecting package httpd for versions less than 2.4.67-1

Details

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddav_fs.

The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than version 1.2.0.

Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove moddavlock.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-29169

Affected packages

Azure Linux:3 / httpd

Package

Name: httpd
Purl: pkg:rpm/azure-linux/httpd

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.67-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86019.json"