CVE-2026-93546

An integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 can be triggered by an authenticated WebDAV client that already has write access. The client sends PROPPATCH requests that declare a very large number of XML namespaces, overflowing an integer in the property-handling path. A successful trigger crashes worker processes and can persistently corrupt that directory's WebDAV property database, causing denial of service and lasting data integrity damage. Only servers that load mod_dav_fs and grant authenticated write access are affected; unauthenticated remote attackers cannot reach the flaw. There is no known public proof of concept and no evidence of exploitation in the wild.

What to do: Disable mod_dav_fs where WebDAV is unused, and restrict authenticated write access to trusted clients only. Upgrade Apache HTTP Server once a release newer than 2.4.68 is available from Apache; until then watch error logs for worker crashes and check WebDAV property databases for corruption after PROPPATCH activity.