CVE-2026-46729

Summary

A NULL pointer dereference vulnerability in Apache HTTP Server's mod_heartmonitor module allows attackers to cause the server to crash via an unicast listener, leading to a denial of service condition. This affects versions 2.4.0 through 2.4.68 and can be exploited by sending specially crafted requests to the heartmonitor endpoint.

Exploitability

Exploitation is relatively straightforward as it requires only sending malformed requests to the unicast listener endpoint, with no authentication or complex preconditions needed.

Blast radius

The impact could affect all users of the affected Apache versions, potentially causing widespread service disruption if attackers repeatedly exploit this vulnerability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache HTTP Server 2.4.69 or later to remediate this NULL pointer dereference vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.