AI analysis
A memory calculation bug (CWE-789, described as a shared lock overflow) in mod_dav in Apache HTTP Server allows an attacker who is already permitted to create WebDAV locks to crash server child processes. It is triggered over the network by lock operations; no user interaction is required, but low privileges (lock-creation permission) are required. Impact is limited to availability: there is no confidentiality or integrity impact, and the CVSS 3.1 score is 4.3 (medium). Affected releases are httpd 2.4.67 and earlier; Apache recommends upgrading to 2.4.69. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.
What to do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, disable mod_dav if WebDAV is not required, and restrict which authenticated users can create WebDAV locks. After patching, confirm child processes are no longer crashing under normal lock use.
Affected
| Apache Software Foundation Apache HTTP Server (httpd) mod_dav | 2.4.67 and earlier (fixed in 2.4.69) |
Estimated exposure
largemillions of Apache httpd installs on affected versions; WebDAV lock-capable subset plausibly tens of thousands or more (exact mod_dav count unknown) — Apache HTTP Server is one of the most widely deployed web servers; public web surveys and internet scans consistently show millions of exposed httpd instances, and 2.4.67 and earlier covers essentially the pre-fix 2.4 installed base. The…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue