CVE-2026-42528 — Apache HTTP Server: mod_dav shared lock overflow

CVE-2026-42528

Apache HTTP Server: mod_dav shared lock overflow PUBLISHED

Description (CNA)

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache HTTP Server	affected 0 through 2.4.68

CWE

CWE-789

References

https://httpd.apache.org/security/vulnerabilities_24.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/01/12