CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow
A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.
Users are recommended to upgrade to version 2.4.69, which fixes this issue
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to create WebDAV locks. Systems that do not grant untrusted users that capability are not exposed to this attack path.
What is the likely impact of exploitation?
Successful exploitation can crash Apache HTTP Server child processes, causing a denial-of-service condition. The provided information does not indicate code execution or data disclosure.
Which versions should be remediated?
Apache HTTP Server 2.4.67 and earlier are affected. Upgrade to version 2.4.69, which fixes the issue.
What can be done before upgrading?
Restrict permission to create WebDAV locks, especially for untrusted users, to reduce exposure until the server can be upgraded.