CVE-2026-93546

Apache HTTP Server: mod_dav_fs namespace overflow

high · 8.8

Published Oct 1, 2026, 16:19 UTC

Description

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.