CVE-2026-42528 - Vulnerability Details - OpenCVE

Description

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue

Published: 2026-10-01

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache HTTP Server

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.4.68

No data.

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://httpd.apache.org/security/vulnerabilities_24.html

History

Thu, 01 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
Title		Apache HTTP Server: mod_dav shared lock overflow
Weaknesses		CWE-789
References		https://httpd.apache.org/security/vulnerabilities_24.html

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-10-01T15:52:51.682Z

Updated: 2026-10-01T16:20:44.093Z

Reserved: 2026-04-28T14:47:08.369Z

Link: CVE-2026-42528

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-01T16:17:43.927

Modified: 2026-10-01T16:17:43.927

Link: CVE-2026-42528

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-789
Memory Allocation with Excessive Size Value

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42528", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-04-28T14:47:08.369Z", "datePublished": "2026-10-01T15:52:51.682Z", "dateUpdated": "2026-10-01T16:20:44.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-01T15:52:51.682Z"}, "title": "Apache HTTP Server: mod_dav shared lock overflow", "problemTypes": [{"descriptions": [{"description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "cweId": "CWE-789", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache HTTP Server", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2.4.68", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.<br><br>Users are recommended to upgrade to version 2.4.69, which fixes this issue<br>"}]}], "references": [{"url": "https://httpd.apache.org/security/vulnerabilities_24.html", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "timeline": [{"time": "2026-04-27T17:33:00.000Z", "lang": "en", "value": "Report received"}, {"time": "2026-10-01T12:00:00.000Z", "lang": "en", "value": "fixed in 2.4.x by r1938652"}, {"time": "2026-10-01T12:00:00.000Z", "lang": "eng", "value": "2.4.69 released"}], "credits": [{"lang": "en", "value": "Zhenpeng (Leo) Lin at depthfirst", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T16:20:41.491692Z", "id": "CVE-2026-42528", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T16:20:44.093Z"}}]}}