A NULL pointer dereference vulnerability in Apache HTTP Server 2.4.66 and earlier allows unauthenticated remote attackers to trigger denial of service conditions by crashing the server.

This flaw is classified as a NULL Pointer Dereference (CWE-476) residing in the mod_dav_lock module. An unauthenticated attacker can send a maliciously crafted request over the network to trigger the dereference, requiring no user interaction.

A successful exploitation of this vulnerability results in server crashes, leading to service disruption and potential downtime for web applications hosted on the affected infrastructure. With a CVSS score of 7.5, the high availability impact poses significant operational risks for organizations relying on Apache HTTP Server for public facing services, threatening business continuity.

Immediate Action: Upgrade Apache HTTP Server to version 2.4.66 or later, or alternatively remove the vulnerable mod_dav_lock module if it is not required for your environment.

Proactive Monitoring: Monitor server error logs for recurrent restarts and unusual crash signatures associated with module faults, as well as tracking unexpected spikes in network traffic.

Compensating Controls: Deploy Web Application Filters or reverse proxies to inspect incoming HTTP requests and block malformed payloads targeted at WebDAV functionalities.

Public Exploit Available: false / unknown

Organizations utilizing Apache HTTP Server must treat this high severity advisory with urgency by auditing their current software versions. Apply the recommended vendor security updates immediately to eliminate the underlying NULL pointer dereference risk and prevent potential denial of service attacks.