CVE-2026-42528

Apache HTTP Server: mod_dav shared lock overflow

Published Oct 1, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue

Analysis

Technical impact

A memory calculation bug in mod_dav in Apache HTTP Server 2.4.67 and earlier leads to a shared lock overflow when an attacker issues a LOCK request that creates a WebDAV lock. The flaw is a mix of an Incorrect Length Calculation (CWE‑131) and an Integer/Buffer Overflow (CWE‑789) resulting from an improper memory sizing operation, which can corrupt the allocation and cause the server child process to crash.

Affected Systems

All installations of Apache HTTP Server 2.4.67 or earlier that have the mod_dav module enabled and allow creation of WebDAV locks are susceptible. The issue is triggered when the module processes a lock request. The affected product is Apache HTTP Server, with the vendor being the Apache Software Foundation.

Risk and Exploitability

The vulnerability can be exploited by any account that has permission to issue WebDAV LOCK commands. An attacker sends an HTTP(S) request that creates a lock, which triggers the overflow and causes a child process to crash. This results in a denial‑of‑service condition. The CVSS score is 4.3, indicating moderate severity, while EPSS is not available and the flaw is not listed in the CISA KEV catalog. No code execution or data exfiltration is possible with this bug.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache HTTP Server

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.4.68

Configuration 1 [-]

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Hardened Images
httpd-main-2.4.69-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:74858	2026-10-02T00:00:00Z

Vendor Product Versions

Apache

Http Server

Version	Status	Scheme	Platform
`[0,2.4.68]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Apache HTTP Server 2.4.69 or newer
If WebDAV is not required, disable or remove the mod_dav module
Restrict WebDAV lock creation to authorized users only

Generated by OpenCVE AI on October 2, 2026 at 14:15 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4902-1	apache2 security update
Debian DSA	DSA-6569-1	apache2 security update
Ubuntu USN	USN-9090-1	Apache HTTP Server vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.416% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/10/01/12
https://httpd.apache.org/security/vulnerabilities_24.html
https://nvd.nist.gov/vuln/detail/CVE-2026-42528
https://www.cve.org/CVERecord?id=CVE-2026-42528

History

Oct 2, 2026 9:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:http_server::::::::

Oct 2, 2026 12:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat hummingbird
Weaknesses		CWE-131
CPEs		cpe:/a:redhat:hummingbird:1
Vendors & Products		Redhat Redhat hummingbird
References		https://nvd.nist.gov/vuln/detail/CVE-2026-42528 https://www.cve.org/CVERecord?id=CVE-2026-42528
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 1, 2026 9:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/01/12

Oct 1, 2026 8:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache http Server
Vendors & Products		Apache Apache http Server

Oct 1, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 1, 2026 4:00 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
Title		Apache HTTP Server: mod_dav shared lock overflow
Weaknesses		CWE-789
References		https://httpd.apache.org/security/vulnerabilities_24.html