BIT-apache-2026-42528

vendorUSosv

Apache HTTP Server: mod_dav shared lock overflow

view advisory published 2026-10-05Licence: per source

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-42528US	—	0.40% (34th)	—	2026-10-01
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recomme…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/10/01/12ADVISORY
https://httpd.apache.org/security/vulnerabilities_24.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-42528WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan