CVE-2026-42535

Apache can expose WebDAV file-management features. This bug lets someone over the network abuse WebDAV properties to interfere with how Apache stores WebDAV metadata, which can crash Apache’s worker processes—like knocking over the desks your business depends on to answer requests.

This matters if you run Apache HTTP Server and have WebDAV enabled via mod_dav_fs, especially if it’s reachable from the internet or other untrusted networks. The problem does not require a login or user interaction, so any exposed WebDAV functionality can increase risk. Even so, the exposure depends on whether the vulnerable mod_dav_fs/WebDAV path is reachable in your setup.

This is AMBER because the vulnerability can be triggered remotely without authentication and can crash Apache’s child processes, causing service disruption. While there’s no public exploit code on record and no KEV entry, the impact is high and the fixed version is available.

1. Confirm whether you’re using the vulnerable feature:
   • Look for Apache modules and configuration that enable WebDAV via mod_dav_fs (for example, any WebDAV “fs” style usage or directory blocks that configure DAV on filesystem-backed locations).
   • If you can map where mod_dav_fs is loaded (module configuration/virtual host configs), note the affected virtual hosts.
2. Confirm the running version:
   • Identify the exact Apache HTTP Server version currently deployed.
   • The issue applies to Apache 2.4.67 and earlier (per the vendor description), and the fix is in 2.4.68.
3. Upgrade to the fixed version:
   • Upgrade Apache HTTP Server to 2.4.68 as the remediation.
   • Plan for any normal upgrade compatibility checks (restart/reload behavior, module compatibility), especially if you use multiple Apache modules or custom WebDAV configuration.
4. If you cannot upgrade immediately (temporary containment):
   • Disable mod_dav_fs / WebDAV in Apache for any exposed sites, or restrict access so it is not reachable from untrusted networks.
   • If you must keep WebDAV, tighten network access controls so only trusted clients/networks can reach those endpoints.
5. Validate the fix:
   • After upgrade, verify Apache is serving your sites and that WebDAV endpoints (if present) are functioning correctly.
   • Watch for stability: confirm child process crashes are not recurring after the upgrade.
6. Monitor and response:
   • Monitor Apache error logs and any process crash/restart events around periods of elevated requests, especially targeting WebDAV-related paths.

CISA KEV due date: not applicable here (not listed in CISA KEV per provided findings).

Severity is high due to denial of service potential: an unauthenticated attacker over the network can manipulate WebDAV properties that affect the trusted DAV property database used by mod_dav_fs. The mechanism is described as a path/property handling issue in Apache HTTP Server’s mod_dav_fs (Apache 2.4.67 and earlier), where a “WebDAV content author” (i.e., someone who can act through WebDAV) can directly manipulate the property database, potentially crashing child processes. The provided findings state there is no KEV listing and no public exploit code on record; exploitation maturity is therefore not established from the supplied sources. Predicted EPSS is provided by the findings as a low, flat trend, but exploitation likelihood is not the driver here—the risk is driven by the unauthenticated remote DoS behavior and the high impact on availability. KEV absence means there’s no confirmed, cataloged exploitation signal in the provided data.