CVE-2026-29167

Отчет

CISA's 9.8 is a mechanical worst-case UAF score. Their vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — they're treating it as: "network-facing service, memory corruption primitive, assume RCE." This is how CISA-ADP routinely scores any UAF in a network daemon. They don't analyze actual exploitability; they score the theoretical ceiling of the vulnerability class. Apache's LOW reflects what actually happens.

1. Trigger is narrow — mod_ldap must be loaded (not default) AND configured in per-directory context (, , .htaccess). Server-wide LDAP config doesn't trigger it. This is an unusual configuration pattern.
2. UAF in config merging, not request handling — the freed memory is in the per-directory configuration merge path, which constrains the timing window and what objects occupy the freed allocation. This isn't a heap spray-friendly UAF in a hot request path.
3. httpd's process model kills RCE reliability — prefork uses separate processes (crash = one child dies, parent respawns), worker/event have per-process address space. Turning a UAF into reliable RCE against httpd is substantially harder than against a single-threaded daemon with a predictable heap layout.
4. Realistic impact is DoS — the freed pointer will most likely cause a segfault (child crash), not a controlled write primitive. The parent process respawns workers, so even the DoS is transient.

Меры по смягчению последствий

upgrade apache web server to 2.4.68