CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow
Apache HTTP Server: moddavfs namespace overflow
Other sources
Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.69-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Servers running Apache HTTP Server through 2.4.68 with mod_dav_fs enabled are exposed when an authenticated WebDAV client has write access to a directory served through WebDAV.
What does an attacker need to exploit it?
The attacker needs valid authentication as a WebDAV client and write permission to the affected directory. Exploitation is performed with PROPPATCH requests that declare many XML namespaces.
What is the likely impact of successful exploitation?
A successful request can crash Apache worker processes and persistently corrupt the affected directory's property database.