CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow
Authenticated WebDAV clients can crash Apache HTTP Server and corrupt property data via CVE-2026-93546.
Apache disclosed CVE-2026-93546, a moderate integer overflow in mod_dav_fs affecting Apache HTTP Server through 2.4.68. An authenticated WebDAV client with write access can send PROPPATCH requests declaring many XML namespaces to crash worker processes and persistently corrupt a directory's property database. Credit was given to Zhen Kong of Calif.io, in collaboration with Anthropic, and AISLE. The notice does not report exploitation in the wild.
- CVE-2026-93546 is an integer overflow in mod_dav_fs.
- Affected releases are Apache HTTP Server through 2.4.68.
- An authenticated WebDAV writer can crash workers and corrupt property data.
- Apache rated the issue moderate; exploitation is not reported.
Vulnerabilities mentionedAll →
- CVE-2026-935468.8—Integer overflow in Apache HTTP Server mod_dav_fspublished · Apache Software Foundation Apache HTTP Server (mod_dav_fs)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93546 | Integer overflow in Apache HTTP Server mod_dav_fs An integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 can be triggered by an authenticated WebDAV client that already has write access. The client sends PROPPATCH requests that declare a very large number of XML namespaces, overflowing an integer in the property-handling path. A successful trigger crashes worker processes and can persistently corrupt that directory's WebDAV property database, causing denial of service and lasting data integrity damage. Only servers that load mod_dav_fs and grant authenticated write access are affected; unauthenticated remote attackers cannot reach the flaw. There is no known public proof of concept and no evidence of exploitation in the wild. Disable mod_dav_fs where WebDAV is unused, and restrict authenticated write access to trusted clients only. Upgrade Apache HTTP Server once a release newer than 2.4.68 is available from Apache; until then watch error logs for worker crashes and check WebDAV property databases for corruption after PROPPATCH activity. |
Posted by Eric Covener on Oct 01 Severity: moderate Affected versions: - Apache HTTP Server through 2.4.68 Description: Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces. Credit: Zhen Kong (finder) Calif.io in collaboration with Anthropic (finder) AISLE in...
This source does not provide full text. Read it at seclists.org.