CLSA-2026-1782295144 Fix CVE(s): CVE-2026-29169

SECURITY UPDATE: NULL pointer dereference in moddavlock indirect-lock refresh - debian/patches/CVE-2026-29169.patch: replace all six dp- reads in the indirect-lock branch of davgenericrefreshlocks with the resolved dpscan-... values in modules/dav/lock/locks.c so a crafted WebDAV LOCK refresh...

CLSA-2026-1782157735 Fix CVE(s): CVE-2026-29169

SECURITY UPDATE: NULL pointer dereference in moddavlock indirect-lock refresh - debian/patches/CVE-2026-29169.patch: replace all six dp- reads in the indirect-lock branch of davgenericrefreshlocks with the resolved dpscan-... values in modules/dav/lock/locks.c so a crafted WebDAV LOCK refresh...

Apache HTTP Server: mod_dav_lock indirect lock crash

...

UBUNTU-CVE-2026-29169

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than...

CVE-2026-29169

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than...