https://seclists.org/oss-sec/2026/q4/11: CVE-2026-42528: Apache HTTP Server: mod_dav shad lock overflow

Q: Who can exploit this issue?

An attacker needs permission to create WebDAV locks. Systems that do not expose WebDAV lock creation to untrusted users are not described as directly exploitable by this issue.

Q: What is the expected impact of successful exploitation?

Successful exploitation can crash Apache HTTP Server child processes. The provided information describes a denial-of-service impact and does not state that code execution or data disclosure is possible.

Q: Which versions should be remediated?

Apache HTTP Server versions through 2.4.68 are affected. Upgrade to version 2.4.69, which fixes the issue.

Q: What can be done if an upgrade cannot be performed immediately?

Restrict permission to create WebDAV locks, particularly for untrusted users. This reduces exposure because lock-creation permission is required for exploitation.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server<=2.4.68

Frequently Asked Questions

Who can exploit this issue?

An attacker needs permission to create WebDAV locks. Systems that do not expose WebDAV lock creation to untrusted users are not described as directly exploitable by this issue.

What is the expected impact of successful exploitation?

Successful exploitation can crash Apache HTTP Server child processes. The provided information describes a denial-of-service impact and does not state that code execution or data disclosure is possible.

Which versions should be remediated?

Apache HTTP Server versions through 2.4.68 are affected. Upgrade to version 2.4.69, which fixes the issue.

What can be done if an upgrade cannot be performed immediately?

Restrict permission to create WebDAV locks, particularly for untrusted users. This reduces exposure because lock-creation permission is required for exploitation.