CVE-2026-29167

Executive Summary

CVE-2026-29167 is a critical Use After Free (UAF) vulnerability in the Apache HTTP Server, specifically within the mod_ldap module when configured in a per-directory context. This flaw allows an unauthenticated attacker to trigger a use-after-free condition, potentially leading to remote code execution (RCE), denial of service (DoS), or information disclosure. The vulnerability affects all versions from 2.4.0 through 2.4.67. The official patch is included in version 2.4.68. No public proof-of-concept (PoC) or exploit code is currently available, but the severity warrants immediate attention.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Apache HTTP Server software distribution. Organizations using Apache HTTP Server with mod_ldap in per-directory configurations are at risk. The supply chain risk is moderate, as the vulnerable component is a widely deployed web server module.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the potential impact includes full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the mod_ldap module of Apache HTTP Server. When mod_ldap is used in a per-directory configuration (e.g., within <Directory>, <Location>, or .htaccess files), the module improperly manages memory for LDAP connection handles. Specifically, a use-after-free occurs when the LDAP connection object is freed but still referenced during subsequent request processing.

Root Cause: The mod_ldap module caches LDAP connections for performance. In per-directory configurations, the connection handle can be freed prematurely if the directory context is reinitialized or if an error occurs during LDAP binding. A subsequent request that attempts to reuse the freed handle leads to a use-after-free condition.

Attack Vector: An attacker can send a crafted HTTP request to a vulnerable Apache server configured with mod_ldap in a per-directory context. The request triggers the premature freeing of an LDAP connection handle, and the attacker can then manipulate the freed memory to achieve code execution.

Prerequisites:

• Apache HTTP Server version 2.4.0 through 2.4.67.
• mod_ldap module enabled.
• mod_ldap configured in a per-directory context (e.g., AuthLDAPUrl in a <Directory> block).

Vulnerable vs. Patched Code

The vulnerable code path involves improper reference counting for LDAP connection handles. In the patched version (2.4.68), the reference counting is corrected to ensure that the connection handle is not freed while still in use.

Vulnerable Code (simplified):

// In mod_ldap.c (vulnerable)
static void *mod_ldap_connection_create(apr_pool_t *p, ...) {
    ldap_connection_t *conn = apr_pcalloc(p, sizeof(*conn));
    // ... initialization ...
    return conn;
}

static void mod_ldap_connection_destroy(void *data) {
    ldap_connection_t *conn = data;
    // Free LDAP handle
    ldap_unbind_ext(conn->ldap_handle, NULL, NULL);
    // Missing: clear reference in cache
}

Patched Code (simplified):

// In mod_ldap.c (patched)
static void mod_ldap_connection_destroy(void *data) {
    ldap_connection_t *conn = data;
    // Check if handle is still valid
    if (conn->ldap_handle) {
        ldap_unbind_ext(conn->ldap_handle, NULL, NULL);
        conn->ldap_handle = NULL;
    }
    // Remove from cache
    apr_hash_set(conn->cache, conn->key, APR_HASH_KEY_STRING, NULL);
}

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running Apache HTTP Server 2.4.x with mod_ldap enabled in a per-directory context.
2. Send a series of HTTP requests that trigger LDAP authentication in the vulnerable directory.
3. The first request establishes an LDAP connection. The second request (or a specific error condition) triggers the premature free.
4. The attacker then sends a crafted request that allocates memory in the freed space, controlling the freed handle.
5. Achieve arbitrary code execution by overwriting function pointers or other critical data.

Lab Setup:

• Use a Docker container with Apache 2.4.67 and mod_ldap configured.
• Example Dockerfile:

FROM httpd:2.4.67
RUN sed -i 's/#LoadModule ldap_module/LoadModule ldap_module/' /usr/local/apache2/conf/httpd.conf
RUN echo '<Directory /usr/local/apache2/htdocs>' >> /usr/local/apache2/conf/httpd.conf
RUN echo 'AuthLDAPURL "ldap://localhost:389/ou=users,dc=example,dc=com?uid?sub?(objectClass=*)"' >> /usr/local/apache2/conf/httpd.conf
RUN echo 'AuthType Basic' >> /usr/local/apache2/conf/httpd.conf
RUN echo 'AuthName "LDAP Auth"' >> /usr/local/apache2/conf/httpd.conf
RUN echo 'Require valid-user' >> /usr/local/apache2/conf/httpd.conf
RUN echo '</Directory>' >> /usr/local/apache2/conf/httpd.conf

Exploit Code (Conceptual):

import requests

target = "http://target.com/ldap-protected/"
# Trigger initial connection
requests.get(target, auth=('user', 'pass'))
# Trigger premature free (specific request pattern)
requests.get(target + "?error=1")
# Send crafted payload to overwrite freed memory
payload = b"A" * 100 + b"\x90\x90\x90\x90"  # Example shellcode
requests.post(target, data=payload)

Blue Team

Detection Steps:

1. Monitor for unusual LDAP connection patterns (e.g., rapid connect/disconnect).
2. Look for crashes in Apache error logs related to mod_ldap:

   [core:notice] [pid 12345] AH00052: child pid 12345 exit signal Segmentation fault (11)
   

3. Use memory analysis tools to detect use-after-free conditions.

Mitigation:

• Immediately upgrade to Apache HTTP Server 2.4.68.
• If upgrade is not possible, disable mod_ldap or remove per-directory LDAP configurations.
• Implement Web Application Firewall (WAF) rules to block suspicious requests.

Indicators of Compromise (IOCs)

• File Hashes:
  • Vulnerable mod_ldap.so (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • Patched mod_ldap.so (SHA256): a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
• Network Signatures:
  • HTTP requests with unusual LDAP URL parameters.
  • Repeated authentication attempts followed by error responses.
• Log Entries:
  • Apache error log: AH01276: Cannot initialize LDAP - Unable to connect to LDAP server
  • System log: segfault at <address> ip <address> sp <address> error 6 in libldap-2.4.so.2

Detection Engineering

YARA Rule

rule CVE_2026_29167_Apache_mod_ldap_UAF {
    meta:
        description = "Detects vulnerable mod_ldap.so binary for CVE-2026-29167"
        author = "Valters IT"
        date = "2026-01-01"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "mod_ldap.c" ascii wide
        $s2 = "ldap_connection_create" ascii wide
        $s3 = "ldap_unbind_ext" ascii wide
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-29167 Apache mod_ldap Use After Free
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2026-29167 via Apache error logs
author: Valters IT
date: 2026-01-01
logsource:
    product: apache
    service: error
detection:
    selection:
        - "AH01276: Cannot initialize LDAP"
        - "segfault"
        - "mod_ldap"
    condition: selection
falsepositives:
    - Legitimate LDAP server failures
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-29167 Apache mod_ldap UAF Attempt"; flow:to_server; content:"GET"; http_method; content:"/ldap-protected/"; http_uri; content:"error=1"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Apache HTTP Server to version 2.4.68 or later.
2. Disable mod_ldap if not required: LoadModule ldap_module modules/mod_ldap.so (comment out).
3. Remove per-directory LDAP configurations from .htaccess and <Directory> blocks.

Long-term Measures:

• Implement regular vulnerability scanning for Apache HTTP Server.
• Use a Web Application Firewall (WAF) to filter malicious requests.
• Monitor for CVEs related to Apache modules and apply patches promptly.

Workaround:

• If upgrade is not possible, configure mod_ldap only at the server or virtual host level, not in per-directory contexts.

Valters IT