CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow
Moderate CVE-2026-42528 in Apache mod_dav lets WebDAV lock creators crash httpd child processes.
CVE-2026-42528 is a moderate-severity memory calculation bug in Apache HTTP Server's mod_dav. An attacker who already has permission to create WebDAV locks can crash server child processes. The post lists affected versions through 2.4.68 and also describes the bug in 2.4.67 and earlier. Users are advised to upgrade to 2.4.69; no in-the-wild exploitation is reported.
- CVE-2026-42528 is a memory calculation bug in mod_dav.
- Attackers allowed to create WebDAV locks can crash child processes.
- Affected releases are listed through 2.4.68; 2.4.69 fixes it.
- Apache rates the issue moderate severity.
Vulnerabilities mentionedAll →
- CVE-2026-425284.3—mod_dav lock memory bug crashes Apache HTTP Serverpublished · Apache Software Foundation Apache HTTP Server (httpd) mod_dav
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42528 | mod_dav lock memory bug crashes Apache HTTP Server A memory calculation bug (CWE-789, described as a shared lock overflow) in mod_dav in Apache HTTP Server allows an attacker who is already permitted to create WebDAV locks to crash server child processes. It is triggered over the network by lock operations; no user interaction is required, but low privileges (lock-creation permission) are required. Impact is limited to availability: there is no confidentiality or integrity impact, and the CVSS 3.1 score is 4.3 (medium). Affected releases are httpd 2.4.67 and earlier; Apache recommends upgrading to 2.4.69. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known. Upgrade Apache HTTP Server to 2.4.69 or later. Until then, disable mod_dav if WebDAV is not required, and restrict which authenticated users can create WebDAV locks. After patching, confirm child processes are no longer crashing under normal lock use. |
Posted by Eric Covener on Oct 01 Severity: moderate Affected versions: - Apache HTTP Server through 2.4.68 Description: A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue Credit: Zhenpeng (Leo) Lin at depthfirst (finder) References:...
This source does not provide full text. Read it at seclists.org.