CVE-2026-46729

⚠️ high

Summary

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS Score

7.5

High

EPSS Score

0.5

Exploit Probability

Published Date

2026-10-01

First Seen: 2026-10-04

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,863 vulnerabilities in our database.

#117,960

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Oct 1, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Zhang San Ankit Prateek (OffByQuant) Zhen Kong SeungHyun Cho of KISA 4ra1n, pyn3rd and unam4 Ryoma Nishioka Keita Sode

SSVC data provided by CISA

Last Modified 2026-10-08

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-476

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
apache	http_server	Affected	> 2.4.0 < 2.4.69
apache	http_server	Affected	> 2.4.60 < 2.4.69

🔗 References 2

https://httpd.apache.org/security/vulnerabilities_24...

Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/10/0...

Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42356	ℹ️ low	3.7	0.5	Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI pr...	2026-10-01
CVE-2026-42528	🔶 medium	4.3	0.4	A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebD...	2026-10-01
CVE-2026-47360	⚠️ high	7.5	0.4	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie modu...	2026-10-01
CVE-2026-48005	⚠️ high	7.5	0.6	Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all p...	2026-10-01
CVE-2026-56153	⚠️ high	7.5	0.5	Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: fr...	2026-10-01
CVE-2026-56154	⛔ critical	9.8	0.6	Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue a...	2026-10-01

These CVEs affect the same products