CVE-2026-46729
CVE-2026-46729: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityHigh7.5
High [CVE-2026-46729] NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener
CVE-2026-46729Source published Source updated
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
- Affected products in this advisory
- Apache HTTP Servers
- Source-reported affected versions
- 2.4.0 through 2.4.68.
- through 2.4.68
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-46729] Denial of Service via NULL pointer dereference
CVE-2026-46729Source published Source updated
Denial of Service via NULL pointer dereference. Red Hat rates this important (CVSS 7.5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more.
- Related products — impact not confirmed
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
3 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- httpd-main-2.4.69-1.hum1
- RHSA-2026:74858
- Mitigation guidance
- Disable the mod_heartmonitor module or restrict network access to the monitoring port: 1. Disable the module: Comment out the LoadModule directive for mod_heartmonitor in the Apache configuration (typically located in `/etc/httpd/conf.modules.d/00-base.conf` or a custom configuration file): # LoadModule heartmonitor_module modules/mod_heartmonitor.so Then reload the web server configuration: systemctl reload httpd 2. Restrict network reachability: If mod_heartmonitor is required, configure firewall rules using firewalld to permit traffic to the HeartbeatListen unicast port only from authorized backend nodes: firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE> firewall-cmd --reload Caveat: Disabling mod_heartmonitor prevents mod_lbmethod_heartbeat from receiving backend node status, which disables heartbeat-based dynamic load balancing. Warning: Modifying Apache configuration files requires reloading or restarting httpd, which may briefly interrupt active network connections.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.