CVE-2026-42528

MediumCVSS 4.3/10Last modified Oct 6, 2026

Description

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-789

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	<= 2.4.68

References

https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/01/12Mailing List, Third Party Advisory

Timeline

Published: Oct 1, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-42537.2A security flaw has been discovered in Tenda AC8 16.03.50.11. This affects the function route_set_user_policy_rule of the file /cgi-bin/Uplo CVE-2026-425308.1NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, CVE-2026-425325.5A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A speci CVE-2026-425338.1A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the m CVE-2026-425345.3NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade reso CVE-2026-425359.1A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property CVE-2026-425367.5Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects A CVE-2026-425379.8Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this i CVE-2026-425386.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-425396.5IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 CVE-2026-42549.8A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysTo CVE-2026-425404.3IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28