CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow
Published Oct 1, 2026
·Updated
Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Affected Software
1 affected component
Apache HTTP Server<=2.4.68
Event History
Oct 1, 2026
CVE Published
via MITRE·04:19 PM
Data Sourced
via MITRE·04:19 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Servers running Apache HTTP Server through 2.4.68 with mod_dav_fs enabled are exposed when an authenticated WebDAV client has write access to a directory served through WebDAV.
2
What does an attacker need to exploit it?
The attacker needs valid authentication as a WebDAV client and write permission to the affected directory. Exploitation is performed with PROPPATCH requests that declare many XML namespaces.
3
What is the likely impact of successful exploitation?
A successful request can crash Apache worker processes and persistently corrupt the affected directory's property database.