---
id: CVE-2026-42528
title: >-
  A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows
  an attacker with permission to create WebDAV locks to crash server child
  processes.


  Users are recommended to upgrade to version 2.4.69, which fixes this issue
summary: >-
  A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows
  an attacker with permission to create WebDAV locks to crash server child
  processes.


  Users are recommended to upgrade to version 2.4.69, which fixes this issue
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-789
  - CWE-131
vendor: apache
product: http_server
affected:
  - 'http_server >= 2.4.0, < 2.4.69'
patched:
  - http_server 2.4.69
published: '2026-10-01'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T14:07:28.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42528'
references:
  - url: 'https://httpd.apache.org/security/vulnerabilities_24.html'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/10/01/12'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42528.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42528'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544828'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42528'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42528'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00401
epssPercentile: 0.34161
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-01T16:20:41.491692Z'
ingestedAt: '2026-10-01T18:55:42.356Z'
---

## Overview

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.

Users are recommended to upgrade to version 2.4.69, which fixes this issue

## Affected

- `http_server >= 2.4.0, < 2.4.69`

## Remediation

Upgrade past the affected range:

- `http_server 2.4.69`

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42528.json)