Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-08T15:14:49 httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-22

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

A flaw was found in the `mod_dav_fs` module of Apache HTTP Server. A WebDAV (Web Distributed Authoring and Versioning) content author could exploit a path handling issue to directly manipulate trusted DAV property databases. This manipulation could potentially lead to child process crashes, resulting in a Denial of Service (DoS).

Red Hat Enterprise Linux 10 2026-07-01T00:00:00Z RHSA-2026:34109 httpd-0:2.4.63-13.el10_2.4 Red Hat Enterprise Linux 9 2026-07-20T00:00:00Z RHSA-2026:41906 httpd-0:2.4.62-13.el9_8.5 Red Hat Hardened Images 2026-06-10T00:00:00Z RHSA-2026:25042 httpd-main-2.4.68-1.hum1 Red Hat Enterprise Linux 6 Out of support scope httpd Red Hat Enterprise Linux 7 Out of support scope httpd Red Hat Enterprise Linux 8 Fix deferred httpd:2.4/httpd Red Hat JBoss Core Services Affected jbcs-httpd24-httpd Red Hat JBoss Core Services Affected mod_dav_fs.so https://www.cve.org/CVERecord?id=CVE-2026-42535 https://nvd.nist.gov/vuln/detail/CVE-2026-42535 https://httpd.apache.org/security/vulnerabilities_24.html