CVE-2026-93546
published 2026-10-01CVE-2026-93546: Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.43%
36.9th percentile
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | <= 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache HTTP Server up to 2.4.68 mod_dav_fs integer overflow (Nessus ID 371689 / WID-SEC-2026-3703)
vuldb·2026-10-25·CVSS 8.8
CVE-2026-93546 [HIGH] Apache HTTP Server up to 2.4.68 mod_dav_fs integer overflow (Nessus ID 371689 / WID-SEC-2026-3703)
A vulnerability, which was classified as problematic, has been found in Apache HTTP Server up to 2.4.68. This issue affects some unknown processing of the component mod_dav_fs. This manipulation causes integer overflow.
This vulnerability is registered as CVE-2026-93546. Remote exploitation of the attack is possible. No exploit is available.
GHSA
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property da
ghsa_unreviewed·2026-10-01
CVE-2026-93546 [HIGH] CWE-190 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property da
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Red Hat
httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
vendor_redhat·2026-10-01·CVSS 8.8
CVE-2026-93546 [HIGH] CWE-190 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
A flaw was found in httpd. An integer overflow in the mod_dav_fs module occurs when processing Web Distributed Authoring and Versioning (WebDAV) PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash server worker processes, causing a Denial of Service (DoS), and persistently corrupt the directory's property database.
Package: httpd (Red Hat Enterprise Linux 10) - Affected
Package: httpd (Red Hat Enterprise Linux 6) - Out of support scope
Package: httpd (Red Hat Enterprise Linux 7) - Affected
Package: httpd:2.4/httpd (Red Hat Enterprise Linux 8) - Affected
Package: httpd (Red Hat Enterprise Linux 9) - Affected
Package: h
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93546 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs [fedora-all]
bugzilla·2026-10-02·CVSS 8.8
CVE-2026-93546 [HIGH] CVE-2026-93546 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs [fedora-all]
CVE-2026-93546 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Bugzilla
CVE-2026-93546 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
bugzilla·2026-10-01·CVSS 8.8
CVE-2026-93546 [HIGH] CVE-2026-93546 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
CVE-2026-93546 httpd: httpd: Denial of Service via integer overflow in mod_dav_fs
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
2026-10-01
Published