https://seclists.org/oss-sec/2026/q4/29: CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow

Q: Which deployments are exposed to this issue?

Apache HTTP Server deployments through 2.4.68 are affected where mod_dav_fs is in use and a WebDAV client has authenticated write access. The issue is triggered through PROPPATCH requests.

Q: What level of access does an attacker need?

An attacker must be an authenticated WebDAV client with write access. The provided information does not indicate that unauthenticated clients can exploit the issue.

Q: What can exploitation cause?

Successful exploitation can crash Apache worker processes and persistently corrupt the affected directory's property database. The corruption is associated with PROPPATCH requests declaring many XML namespaces.

Q: What should be done to remediate the issue?

Upgrade to Apache HTTP Server 2.4.69, which was released on 2026-10-01. The issue was fixed in the 2.4.x branch by revision r1938682.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server deployments through 2.4.68 are affected where mod_dav_fs is in use and a WebDAV client has authenticated write access. The issue is triggered through PROPPATCH requests.

What level of access does an attacker need?

An attacker must be an authenticated WebDAV client with write access. The provided information does not indicate that unauthenticated clients can exploit the issue.

What can exploitation cause?

Successful exploitation can crash Apache worker processes and persistently corrupt the affected directory's property database. The corruption is associated with PROPPATCH requests declaring many XML namespaces.

What should be done to remediate the issue?

Upgrade to Apache HTTP Server 2.4.69, which was released on 2026-10-01. The issue was fixed in the 2.4.x branch by revision r1938682.