Executive brief
The Apache HTTP Server is a widely used web server for hosting websites and applications. A vulnerability in its LDAP module could allow an attacker to cause a service crash or potentially execute unauthorized code when the server is configured to use LDAP on a per-directory basis. This could lead to website downtime or a disruption in services that rely on the server.
Technical details
A use-after-free (UAF) vulnerability exists in Apache HTTP Server's mod_ldap module (CWE-416). The flaw is triggered when mod_ldap is used in a per-directory configuration. An attacker could potentially exploit this memory corruption issue to cause a denial-of-service (DoS) via a child process crash or achieve arbitrary code execution, though the vendor rates the impact as 'low'. The issue affects versions 2.4.0 through 2.4.67 and is resolved in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-03-02: disclosed: Reported to the Apache security team
- 2026-06-03: patched: Fixed in development branch (r1934935)
- 2026-06-08: advisory: Public advisory and version 2.4.68 released