Apache HTTP Server flaws can crash the server or possibly run code
Original title: USN-9090-1: Apache HTTP Server vulnerabilities
One bug needs WebDAV lock rights; another is a one-byte overflow a remote attacker might exploit.
Ubuntu security notice USN-9090-1 covers flaws in Apache HTTP Server. A mod_dav memory-size error when handling WebDAV locks (CVE-2026-42528) could let someone permitted to create locks crash the server. A one-byte stack buffer overflow in mod_vhost_alias (CVE-2026-109163) could let a remote attacker cause a crash or possibly execute arbitrary code. The excerpt also starts describing a mod_md issue but cuts off.
Unconfirmed: Affected and fixed versions are not in the excerpt, and the mod_md issue is truncated.
- CVE-2026-42528 is a mod_dav miscalculation of memory sizes for WebDAV locks.
- Only an attacker allowed to create WebDAV locks could trigger that crash.
- CVE-2026-109163 is a one-byte stack overflow in mod_vhost_alias.
- The excerpt begins a mod_md issue but does not finish describing it.
Impact: denial of service, and possibly arbitrary code execution
| Product | Affected |
|---|---|
| Apache HTTP Server | — |
- Vendors
- Apache
- Products
- Apache HTTP Server
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109163 | Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69 | — | — | ||
| CVE-2026-42528 | mod_dav lock memory bug crashes Apache HTTP Server | 4.3 | — |
From the original article
Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.