CVE detail
CVE-2026-29167
Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 16.1 · diversity 15.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
4 source links · newest first
Information published.
vendormsrc.microsoft.comJun 11, 2026, 8:02 AM- http://www.openwall.com/lists/oss-security/2026/06/09/1www.openwall.com
No excerpt available.
Exploitwww.openwall.comJun 8, 2026, 4:16 PM - http://www.openwall.com/lists/oss-security/2026/06/08/4www.openwall.com
No excerpt available.
Exploitwww.openwall.comJun 8, 2026, 4:16 PM - https://httpd.apache.org/security/vulnerabilities_24.htmlhttpd.apache.org
No excerpt available.
Vendor Advisoryhttpd.apache.orgJun 8, 2026, 4:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-48913CVSS 7.3 · High
Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.
- CVE-2019-10082CVSS 9.1 · Critical
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
- CVE-2019-0196CVSS 5.3 · Medium
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison…
- CVE-2019-0211CVSS 7.8 · High
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by…
- CVE-2017-9798CVSS 7.5 · High
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigur…
- CVE-2017-9789CVSS 7.5 · High
When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially errati…