CVE-2026-42528

medium

Description

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue

References

https://httpd.apache.org/security/vulnerabilities_24.html

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90885

http://www.openwall.com/lists/oss-security/2026/10/01/12

Details

Source: Mitre, NVD

Published: 2026-10-01

Updated: 2026-10-01

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L