CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow
Authenticated WebDAV clients can crash Apache HTTP Server and corrupt property data via CVE-2026-93546.
Apache disclosed CVE-2026-93546, a moderate integer overflow in mod_dav_fs affecting Apache HTTP Server through 2.4.68. An authenticated WebDAV client with write access can send PROPPATCH requests declaring many XML namespaces to crash worker processes and persistently corrupt a directory's property database. Credit was given to Zhen Kong of Calif.io, in collaboration with Anthropic, and AISLE. The notice does not report exploitation in the wild.
52