CVE-2026-42528

Think of WebDAV as a shared drawer where approved users can 'lock' files to edit them. A flaw in how Apache counts the memory needed for these locks means someone with drawer access can jam it in a way that crashes the whole filing cabinet (the server process). Visitors to your site would see errors or downtime until the process restarts.

This matters to you if you run a website or service on Apache HTTP Server with the WebDAV feature (mod_dav) turned on, especially if multiple users or applications are allowed to create file locks through it. It is not a risk if WebDAV/mod_dav is disabled or if no one other than fully trusted administrators can create locks.

This is reachable over the network with low effort — any user who already has permission to create a WebDAV lock, even a low-privileged one, can crash the server without any special timing or interaction. There's no evidence yet of this being used in real attacks, but the attack is simple, a fix is already available, and crashed worker processes mean your site or application going down, so this should be treated as urgent and patched promptly rather than queued for a routine update cycle.

Confirm your Apache HTTP Server version and whether mod_dav is loaded (check httpd -M or your config for LoadModule dav_module). If mod_dav is loaded, check your DAV configuration to see which accounts/applications can issue LOCK requests (e.g. via WebDAV clients, CMS plugins, or custom integrations). All versions up to and including 2.4.67 are affected; upgrade to 2.4.69 or later, which contains the fix (no intermediate release addresses it per the vendor's advisory). There is no documented breaking-change concern for this specific fix beyond standard httpd upgrade testing. As a temporary workaround if you cannot patch immediately, disable mod_dav or restrict WebDAV lock permissions to a minimal, fully trusted set of accounts. After patching, monitor for unexpected worker-process restarts or crash-loop behavior in your httpd error logs as a sign of attempted exploitation. No CISA KEV listing exists for this CVE, so there is no federal remediation deadline, but the vendor's own advisory should be treated as the authoritative patch guidance.

CVSS 4.3 (Medium), vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L — network-exploitable, low complexity, requires low-privilege authentication, no user interaction, impacts availability only (worker-process crash), no confidentiality/integrity impact. Weakness class is CWE-789 (Memory Allocation with Excessive Size Value), stemming from an incorrect memory-size calculation in mod_dav's shared-lock handling. No public exploit code is on record, it is not listed in CISA's Known Exploited Vulnerabilities catalog, and news reporting on this CVE shows no confirmed real-world exploitation — press attention is limited to a roundup mention. Predicted exploitation likelihood is low per EPSS modeling. Fixed in Apache HTTP Server 2.4.69.