by Kastro
Paper/Archive/CVE-2026-42535

CVE-2026-42535

Apache Software Foundation Apache HTTP Server — Apache HTTP Server: mod_dav_fs protected directory access

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 45.3.453 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache HTTP Server≤ 2.4.67–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryhttpd.apache.org/security/vulnerabilities_24.htmlrefopenwall.com/lists/oss-security/2026/06/08/8