BIT-apache-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow

Q: Who is exposed to this issue?

Apache HTTP Server deployments through 2.4.68 are exposed if they provide WebDAV access and an authenticated client has write permission to the affected directory.

Q: What does an attacker need to exploit it?

The attacker needs valid authentication and WebDAV write access. Exploitation uses PROPPATCH requests that declare many XML namespaces.

Q: What is the likely impact of successful exploitation?

An attacker can crash Apache worker processes and persistently corrupt the property database for a directory. The reported severity vector indicates high confidentiality, integrity, and availability impact.

Published Oct 1, 2026

Updated

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

Affected Software

1 affected component

Apache HTTP Server<=2.4.68

Event History

Oct 1, 2026

CVE Published

via OSV·04:19 PM

Data Sourced

via OSV·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache HTTP Server deployments through 2.4.68 are exposed if they provide WebDAV access and an authenticated client has write permission to the affected directory.

What does an attacker need to exploit it?

The attacker needs valid authentication and WebDAV write access. Exploitation uses PROPPATCH requests that declare many XML namespaces.

What is the likely impact of successful exploitation?

An attacker can crash Apache worker processes and persistently corrupt the property database for a directory. The reported severity vector indicates high confidentiality, integrity, and availability impact.

BIT-apache-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?