Apache HTTP Server: Integer overflow in mod_dav_fs (WebDAV)
Summary
An integer overflow in the mod_dav_fs WebDAV module of Apache HTTP Server through 2.4.68 can be triggered by an authenticated WebDAV client with write access. Using PROPPATCH requests that declare many XML namespaces, an attacker can crash worker processes and persistently corrupt a directory's property database. Servers without mod_dav_fs or without publicly writable WebDAV shares are not exposed.
Affected
- Apache HTTP Server through 2.4.68 (default configuration: unaffected)
- Only where mod_dav_fs is loaded and WebDAV with write access is enabled
Fixed in
- Apache HTTP Server 2.4.69 (released 2026-10-01)
- Distribution packages: check the vendor status for your platform (status varies, e.g. Debian sid fixed; Ubuntu, SUSE and some other releases pending at time of research)
Workaround
- Disable mod_dav_fs (dav_fs_module) if WebDAV is not required
- Alternatively, block the PROPPATCH method for the affected Directory or Location; this keeps file sharing but prevents property edits
- Limit write access on WebDAV collections to users who need it
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof-of-concept found in research (not exhaustive).
Our recommendation
- Run httpd -M (or equivalent) to check whether dav_fs_module is loaded and where WebDAV is published.
- If WebDAV is unused, disable mod_dav_fs now.
- If WebDAV is needed, upgrade to 2.4.69 or the distribution's fixed package; until then, restrict PROPPATCH and write access.
- Review WebDAV accounts and their write permissions.
- Note: scores differ by source (CVSS 8.8 from CNA; lower scores from some distributions); the real impact is likely availability and integrity rather than full compromise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache HTTP Server 2.4 vulnerabilities httpd.apache.org
- oss-security: CVE-2026-93546 www.openwall.com
- Debian Security Tracker security-tracker.debian.org
- Red Hat CVE page access.redhat.com
- Ubuntu CVE page ubuntu.com
- SUSE CVE page www.suse.com
- Amazon Linux ALAS explore.alas.aws.amazon.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:56.
Original description (NVD)
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.