Apache HTTP Server mod_dav_lock NULL pointer dereference (CVE-2026-29169)

Summary

A malicious request may crash a server using mod_dav_lock.

Vulnerability ID	Vulnerability Overview
CVE-2026-29169	A NULL pointer dereference in mod_dav_lock can terminate the server process. The issue requires use of this module, which is not used internally by mod_dav or mod_dav_fs.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices