From 27603cd4d7a0ad4d9ead2e3ddc911fb32eaf9373 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 25 Aug 2026 11:08:23 +0200
Subject: [PATCH] Resolves: RHEL-190819 - httpd: Apache HTTP Server: Arbitrary
 code

  execution or denial of service via use-after-free in mod_ldap per-directory
  configuration (CVE-2026-29167)
---
 httpd-2.4.63-CVE-2026-29167.patch | 46 +++++++++++++++++++++++++++++++
 httpd.spec                        |  9 +++++-
 2 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.63-CVE-2026-29167.patch

diff --git a/httpd-2.4.63-CVE-2026-29167.patch b/httpd-2.4.63-CVE-2026-29167.patch
new file mode 100644
index 0000000..f401112
--- /dev/null
+++ b/httpd-2.4.63-CVE-2026-29167.patch
@@ -0,0 +1,46 @@
+From 88568e901f41fdd527d180970f7f372f88b93260 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Wed, 3 Jun 2026 17:09:40 +0000
+Subject: [PATCH] Merge r1934932 from trunk:
+
+* modules/ldap/util_ldap.c (uldap_connection_find): Fix inheritance in
+  per-dir context.
+
+Reviewed by: jorton, covener, jfclere
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934935 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/ldap/util_ldap.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index 8c9e58717d..0f13d912c3 100644
+--- a/modules/ldap/util_ldap.c
++++ b/modules/ldap/util_ldap.c
+@@ -897,8 +897,23 @@ static util_ldap_connection_t *
+          */
+         l->secure = secureflag;
+ 
+-        /* save away a copy of the client cert list that is presently valid */
+-        l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs);
++        /* Deep-copy the client cert list into the connection pool so that
++         * the cached connection does not retain pointers into the
++         * (potentially short-lived) per-directory config pool.
++         */
++        l->client_certs = apr_array_copy(l->pool, dc->client_certs);
++        if (!apr_is_empty_array(l->client_certs)) {
++            int i;
++            apr_ldap_opt_tls_cert_t *certs;
++
++            certs = (apr_ldap_opt_tls_cert_t *)l->client_certs->elts;
++            for (i = 0; i < l->client_certs->nelts; i++) {
++                if (certs[i].path)
++                    certs[i].path = apr_pstrdup(l->pool, certs[i].path);
++                if (certs[i].password)
++                    certs[i].password = apr_pstrdup(l->pool, certs[i].password);
++            }
++        }
+ 
+         /* whether or not to keep this connection in the pool when it's returned */
+         l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;
diff --git a/httpd.spec b/httpd.spec
index 198b2ee..31a5de4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -25,7 +25,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.63
-Release: 15%{?dist}
+Release: 16%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -164,6 +164,8 @@ Patch221: httpd-2.4.63-CVE-2026-42535.patch
 Patch222: httpd-2.4.63-CVE-2026-24072.patch
 Patch223: httpd-2.4.63-CVE-2026-33006.patch
 Patch224: httpd-2.4.63-CVE-2026-44186.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2486394
+Patch225: httpd-2.4.63-CVE-2026-29167.patch
 
 # Apache-2.0: everything
 # BSD-3-Clause: util_pcre.c, ap_regex.h
@@ -885,6 +887,11 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Aug 25 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-16
+- Resolves: RHEL-190819 - httpd: Apache HTTP Server: Arbitrary code
+  execution or denial of service via use-after-free in mod_ldap per-directory
+  configuration (CVE-2026-29167)
+
 * Tue Aug 18 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-15
 - Resolves: RHEL-186222 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
   via malicious backend servers (CVE-2026-34356)