CVE-2026-42528CWE-789

CVE-2026-42528

Medium · published October 1, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.8th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-10-01T20:17Z
Affected products (1)
ProductVersionsFixed in
apache/http_server≥ 2.4.0, < 2.4.692.4.69
References (2)
https://httpd.apache.org/security/vulnerabilities_24.html · [email protected]http://www.openwall.com/lists/oss-security/2026/10/01/12 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 01 OCT 15:52Z
    Apache HTTP Server: mod_dav shared lock overflow
    cvelistv5