CVE-2026-93546: Apache HTTP Server WebDAV DOS Vulnerability

CVE-2026-93546 Overview

CVE-2026-93546 is an integer overflow vulnerability in the mod_dav_fs module of Apache HTTP Server through version 2.4.68. An authenticated Web Distributed Authoring and Versioning (WebDAV) client with write access can send PROPPATCH requests that declare many Extensible Markup Language (XML) namespaces, triggering an arithmetic overflow during property processing. The overflow crashes worker processes and persistently corrupts the directory's property database on disk. The flaw is tracked under CWE-190 and affects deployments that expose WebDAV with filesystem-backed storage.

Critical Impact
Authenticated WebDAV users can crash Apache worker processes and permanently corrupt property databases, resulting in loss of availability and integrity for affected directories.

Affected Products

Apache HTTP Server versions through 2.4.68
Deployments with mod_dav_fs enabled for WebDAV access
Any configuration permitting authenticated WebDAV write access

Discovery Timeline

2026-10-01 - CVE-2026-93546 published to the National Vulnerability Database (NVD)
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-93546

Vulnerability Analysis

The vulnerability lives in mod_dav_fs, the filesystem backend for Apache's WebDAV implementation. WebDAV clients use the PROPPATCH method to set or remove properties on resources. Each property declaration can carry an XML namespace, and mod_dav_fs tracks these namespaces when serializing property state to the on-disk database.

When a client submits a PROPPATCH request containing an unusually large number of namespace declarations, size calculations in the property-handling code overflow a fixed-width integer. The overflow leads to an undersized allocation or an incorrect length value used during subsequent operations, causing the worker process to crash. Because the write is interleaved with the serialized property store, the database file is left in an inconsistent state and remains corrupt across restarts.

Root Cause

The root cause is an unchecked integer arithmetic operation on attacker-controlled input, categorized as CWE-190: Integer Overflow or Wraparound. mod_dav_fs does not bound the count of XML namespaces processed per PROPPATCH request before computing buffer sizes, allowing the overflow condition to occur with crafted but syntactically valid WebDAV requests.

Attack Vector

Exploitation requires network access to the Apache HTTP Server, valid credentials, and WebDAV write permission on a target collection. The attacker issues one or more PROPPATCH requests with many xmlns: declarations in the request body. The server consumes the request, triggers the overflow, terminates the worker, and leaves the property database corrupted. Repeated requests can be used to degrade service availability. See the Apache HTTP Server Vulnerabilities advisory for additional technical context.

Detection Methods for CVE-2026-93546

Indicators of Compromise

Unexpected worker process crashes or segmentation faults in Apache error_log entries referencing mod_dav or mod_dav_fs.
Corrupted .davprops or DAV property database files in WebDAV-enabled directories.
PROPPATCH requests in access_log with abnormally large request bodies or high namespace counts.

Detection Strategies

Parse WebDAV request bodies at a reverse proxy or web application firewall (WAF) to count xmlns: declarations per PROPPATCH request and alert on outliers.
Correlate authenticated WebDAV sessions with worker crash events to identify repeated exploitation attempts from the same principal.
Monitor file integrity on WebDAV-backed directories to detect unexpected changes to property database files.

Monitoring Recommendations

Enable verbose logging for mod_dav_fs using LogLevel dav:info to capture property-handling errors.
Forward Apache logs to a centralized analytics platform for cross-session correlation and anomaly identification.
Track worker restart frequency and alert when it exceeds a baseline threshold for WebDAV-serving hosts.

How to Mitigate CVE-2026-93546

Immediate Actions Required

Inventory all Apache HTTP Server instances and identify hosts with mod_dav_fs loaded and WebDAV enabled.
Restrict WebDAV write access to trusted authenticated users only, and remove any guest or anonymous write permissions.
Place WebDAV endpoints behind a WAF or reverse proxy that limits PROPPATCH request body size and rejects excessive XML namespace counts.

Patch Information

Apache has coordinated disclosure through the Apache HTTP Server Vulnerabilities page. Administrators should upgrade to the fixed release listed in that advisory once published and verify that mod_dav_fs reports the patched version. Additional discussion is available on the OpenWall OSS-Security mailing list.

Workarounds

Disable mod_dav_fs on servers that do not require WebDAV by commenting out the LoadModule dav_fs_module directive.
Enforce a LimitXMLRequestBody value small enough to reject oversized PROPPATCH payloads while still supporting legitimate clients.
Require strong authentication and apply per-user rate limits on WebDAV methods to reduce exposure from compromised credentials.

bash

# Example httpd.conf hardening for WebDAV endpoints
<Location /webdav>
    Dav On
    AuthType Basic
    AuthName "WebDAV"
    AuthUserFile /etc/httpd/.htpasswd
    Require valid-user
    LimitXMLRequestBody 102400
    <LimitExcept GET HEAD OPTIONS PROPFIND>
        Require user trusted-writer
    </LimitExcept>
</Location>