Apache HTTP Server mod_dav_lock NULL Pointer Dereference Vulnerability Allowing Denial-of-Service

A NULL pointer dereference vulnerability has been identified in the mod_dav_lock module of Apache HTTP Server. This issue affects versions through 2.4.66. The vulnerability may allow an attacker to crash the server by sending a malicious request. The mod_dav_lock module is not used by default in mod_dav or mod_dav_fs, and its only known application is with mod_dav_svn in Apache Subversion versions prior to 1.2.0.

Impact

Exploitation of this vulnerability can lead to a server crash, causing a denial-of-service condition.

Remediation

Users are advised to upgrade to Apache HTTP Server version 2.4.67, which addresses this vulnerability. Alternatively, mod_dav_lock can be removed.