Apache Software FoundationCVE-2026-46729

Apache HTTP Server: null pointer dereference

High7.5CVE-2026-46729 · Published Oct 1, 2026 · updated Oct 2, 2026

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache HTTP Server Product	>= 2.4.0, <= 2.4.68	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-476

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 1	Apache HTTP Server: integer overflow High8.8Oct 1 CVE-2026-93546No fix yet	High8.8	No fix yet
Oct 1	Apache HTTP Server: use after free High7.3Oct 1 CVE-2026-73637No fix yet	High7.3	No fix yet
Oct 1	Path equivalence: '/./' Medium5.3Oct 1 CVE-2026-79768No fix yet	Medium5.3	No fix yet
Oct 1	Apache HTTP Server: request smuggling High7.5Oct 1 CVE-2026-63718No fix yet	High7.5	No fix yet
Oct 1	Apache HTTP Server: authentication bypass High8.1Oct 1 CVE-2026-73636No fix yet	High8.1	No fix yet
Oct 1	Apache HTTP Server: exposed files Medium5.3Oct 1 CVE-2026-58415No fix yet	Medium5.3	No fix yet