CVE-2026-29167: Apache HTTP Server: mod_ldap per-dir use-after-free

Synopsis

A use-after-free vulnerability exists in the Apache HTTP Server mod_ldap module when processing per-directory LDAP configuration. The flaw is reachable over the network with no authentication required, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected server process. No fix version has been published upstream yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network; an attacker must be able to send HTTP requests to the affected server.

• AuthenticationNot required

  No account or credentials of any privilege level are needed to reach the vulnerable code path.

• Victim interactionNot required

  The attack is fully server-side; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads arbitrary memory from the server process, exposing session tokens, LDAP credentials, and any in-memory application data.
• Writes to freed memory regions, enabling corruption of server state or in-memory data structures.
• Crashes the Apache HTTP Server worker process, causing a denial of service for requests handled by that worker.
• Depending on memory layout at the time of exploitation, arbitrary code execution within the server process context is achievable.