mod_dav_fs (Product): news timeline & CVEs

CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow

Authenticated WebDAV clients can crash Apache HTTP Server and corrupt property data via CVE-2026-93546.

Apache disclosed CVE-2026-93546, a moderate integer overflow in mod_dav_fs affecting Apache HTTP Server through 2.4.68. An authenticated WebDAV client with write access can send PROPPATCH requests declaring many XML namespaces to crash worker processes and persistently corrupt a directory's property database. Credit was given to Zhen Kong of Calif.io, in collaboration with Anthropic, and AISLE. The notice does not report exploitation in the wild.

oss-securityOct 1, 19:00 UTC · 15d agoVulnerability 2 sources CVE-2026-935462· 1 read

CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access

CVE-2026-58415 lets remote clients read WebDAV dead properties from Apache mod_dav_fs state files.

Apache disclosed CVE-2026-58415, a low-severity information disclosure in mod_dav_fs affecting Apache HTTP Server 2.4.0 through 2.4.68 on all platforms, with the issue addressed before 2.4.69. Internal WebDAV state files are accessible to external parties, so a remote client can read dead properties of resources it cannot author by requesting the .DAV state directory with GET. No active exploitation is described.

oss-securityupdated Oct 1, 18:56 UTC · 15d agofirst Oct 1, 18:41 UTC · 15d agoVulnerability 10 sources CVE-2026-584153

mod_dav_fs

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow

CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access