UBUNTU-CVE-2026-58415: Medium severity ubuntu/apache2 vulnerability

Q: Who can exploit this issue?

A remote client can exploit it over the network without authentication or user interaction. Systems using mod_dav_fs with WebDAV content are exposed if they run an affected Apache HTTP Server version.

Q: What information can an attacker obtain?

An attacker can read WebDAV dead properties for resources they are not authorized to author by sending a GET request for the .DAV state directory. The available information is limited to the dead properties stored in those internal state files.

Q: Which Apache HTTP Server versions are affected?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected. The issue is fixed in versions after 2.4.68.

Published Oct 1, 2026

Updated

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

8 affected componentsFixes available

ubuntu/apache2<2.4.7-1ubuntu4.22+esm17

2.4.7-1ubuntu4.22+esm17

ubuntu/apache2<2.4.18-2ubuntu3.17+esm22

2.4.18-2ubuntu3.17+esm22

ubuntu/apache2<2.4.29-1ubuntu4.27+esm13

2.4.29-1ubuntu4.27+esm13

ubuntu/apache2<2.4.41-4ubuntu3.23+esm9

2.4.41-4ubuntu3.23+esm9

ubuntu/apache2<2.4.52-1ubuntu4.25

2.4.52-1ubuntu4.25

ubuntu/apache2<2.4.58-1ubuntu8.17

2.4.58-1ubuntu8.17

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.6

2.4.66-2ubuntu2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.7-1ubuntu4.22+esm17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.18-2ubuntu3.17+esm22
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.29-1ubuntu4.27+esm13
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm9
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.25
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.6

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote client can exploit it over the network without authentication or user interaction. Systems using mod_dav_fs with WebDAV content are exposed if they run an affected Apache HTTP Server version.

What information can an attacker obtain?

An attacker can read WebDAV dead properties for resources they are not authorized to author by sending a GET request for the .DAV state directory. The available information is limited to the dead properties stored in those internal state files.

Which Apache HTTP Server versions are affected?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected. The issue is fixed in versions after 2.4.68.

UBUNTU-CVE-2026-58415: Medium severity ubuntu/apache2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Which Apache HTTP Server versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Which Apache HTTP Server versions are affected?