CVE-2026-42528: Apache HTTP Server mod_dav DoS Vulnerability

CVE-2026-42528 Overview

CVE-2026-42528 is a memory calculation bug in the mod_dav module of Apache HTTP Server versions 2.4.67 and earlier. An attacker with permission to create Web Distributed Authoring and Versioning (WebDAV) locks can trigger the flaw to crash server child processes. The weakness is categorized as [CWE-789] (Memory Allocation with Excessive Size Value) and results in a denial of service condition against the affected worker processes. The Apache HTTP Server project resolved the issue in version 2.4.69. The vulnerability requires authenticated access with lock creation privileges, which limits exposure but does not eliminate risk in multi-tenant or shared WebDAV deployments.

Critical Impact

Authenticated WebDAV users can crash Apache httpd child processes through a malformed lock request, producing repeated availability loss for served content.

Affected Products

• Apache HTTP Server versions 2.4.67 and earlier with mod_dav enabled
• Deployments exposing WebDAV endpoints to authenticated users
• Any Apache httpd 2.4.x build prior to 2.4.69 that loads mod_dav

Discovery Timeline

• 2026-10-01 - CVE-2026-42528 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-42528

Vulnerability Analysis

The vulnerability resides in mod_dav, the Apache module that implements the WebDAV protocol extension to HTTP. WebDAV allows clients to create, move, and lock resources on the server. The LOCK method lets a client claim exclusive or shared access to a resource for a bounded period.

During lock processing, mod_dav performs a memory calculation that produces an incorrect size value. This miscalculation leads the child process to allocate or access memory in a way that terminates the worker. The result is a denial of service limited to the handling child, though repeated requests can degrade overall server availability.

The flaw requires the attacker to hold permission to create WebDAV locks. This constraint narrows the exposed population to deployments where WebDAV is enabled and authenticated users exist. Public-facing WebDAV shares with weak credentials expand the attack surface materially.

Root Cause

The root cause is an incorrect memory size computation in the lock-handling code path of mod_dav. [CWE-789] describes allocations influenced by attacker-controlled input where the resulting size is not validated against reasonable bounds. In this case the miscalculation causes a crash within the Apache child process rather than exploitable memory corruption.

Attack Vector

Exploitation requires network access to the WebDAV endpoint and valid credentials with lock creation rights. The attacker issues a crafted LOCK request that triggers the faulty memory calculation. The child process servicing the request terminates, and Apache spawns a replacement, consuming resources on each iteration. The vulnerability does not expose confidentiality or integrity, only availability.

No proof-of-concept exploit is published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Technical details are available on the Apache HTTP Server Vulnerabilities page and the Openwall OSS Security mailing list.

Detection Methods for CVE-2026-42528

Indicators of Compromise

• Repeated LOCK method requests in Apache access logs targeting WebDAV collections, especially from a small set of authenticated accounts
• Entries in error_log reporting child process segmentation faults or abnormal exits correlated with WebDAV traffic
• Elevated rate of child process restarts recorded by the Apache MPM

Detection Strategies

• Correlate WebDAV LOCK request bursts with child process crash events on the same host within short time windows
• Baseline normal WebDAV lock volumes per user and alert on deviations that coincide with worker termination
• Review authentication logs for accounts issuing lock requests outside expected patterns or source networks

Monitoring Recommendations

• Forward Apache access_log and error_log to a centralized logging platform for query and retention
• Track process-level metrics (child restart counts, segfault signals) through host telemetry and alert on sustained anomalies
• Monitor WebDAV authentication for brute-force or credential stuffing attempts that could enable this attack

How to Mitigate CVE-2026-42528

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.69 or later on all hosts running mod_dav
• Audit which virtual hosts and locations load mod_dav and confirm each one requires WebDAV
• Review WebDAV authentication configuration and rotate credentials for accounts with lock permissions

Patch Information

The Apache HTTP Server project fixed CVE-2026-42528 in version 2.4.69. Administrators should apply vendor packages for their distribution or build from upstream sources. Confirm the running version with httpd -v after deployment. See the Apache HTTP Server 2.4 vulnerabilities page for the authoritative advisory.

Workarounds

• Disable mod_dav on servers that do not require WebDAV by removing or commenting the LoadModule dav_module directive
• Restrict WebDAV endpoints to trusted source networks using Require ip or equivalent access controls
• Remove lock creation privileges from WebDAV users who do not need them

# Example: disable mod_dav in Apache httpd configuration
# /etc/httpd/conf/httpd.conf or /etc/apache2/mods-enabled/

# Comment out the LoadModule directive
# LoadModule dav_module modules/mod_dav.so
# LoadModule dav_fs_module modules/mod_dav_fs.so

# Or restrict WebDAV access by source network
<Location /webdav>
    DAV On
    AuthType Basic
    AuthName "WebDAV"
    AuthUserFile /etc/apache2/webdav.passwd
    Require valid-user
    Require ip 10.0.0.0/8
</Location>

# Verify installed version after patching
httpd -v