NULL Pointer Dereference Vulnerability in Apache HTTP Server by Apache
CVE-2026-46729

7.5HIGH

Key Information:

Vendor: Apache
Status: Apache Http Server
Vendor: CVE Published:; 1 October 2026

What is CVE-2026-46729?

A NULL Pointer Dereference vulnerability exists within the mod_heartmonitor module of Apache HTTP Server, specifically when operating with a unicast listener. This issue can lead to unexpected behavior or application crashes, making it critical for users of affected versions to apply mitigation strategies promptly.

Affected Version(s)

Apache HTTP Server 2.4.0 <= 2.4.68

References

https://httpd.apache.org/security/vulnerabilities_24.html

vendor-advisory

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 1, 2026
Vulnerability Reserved
May 17, 2026

Credit

Zhang San

Ankit Prateek (OffByQuant)

Zhen Kong

SeungHyun Cho of KISA

4ra1n, pyn3rd and unam4

Ryoma Nishioka

Keita Sode

CVE-2026-46729 Data

JSON