Skip to main content

Apache HTTP Server CVE-2026-42535

| EUVDEUVD-2026-35090 CRITICAL
Exposure of Resource to Wrong Sphere (CWE-668)
2026-06-08 apache GHSA-644r-w2gh-w38h
Apache Information Disclosure Apache Http Server Apache Software Foundation
Critical
Disputed · 9.1 Vendor: apache
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (apache) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 09, 2026 - 13:22 vuln.today
CVSS changed
Jun 09, 2026 - 13:22 NVD
9.1 (None) 9.1 (CRITICAL)
CVE Published
Jun 08, 2026 - 15:14 nvd
CRITICAL 9.1
CVE Published
Jun 08, 2026 - 15:14 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.

AnalysisAI

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author to directly manipulate trusted DAV property databases, leading to integrity violations and child process crashes. With a CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) and SSVC technical impact rated 'total' with automatable=yes, the flaw is highly impactful, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The mod_dav_fs module is the filesystem-backed provider for mod_dav, Apache's implementation of the WebDAV (RFC 4918) protocol extension to HTTP. It maintains per-resource property databases (typically stored as DBM-style files alongside served content) that record dead properties and lock state used by WebDAV clients. The CWE-668 classification (Exposure of Resource to Wrong Sphere) indicates that insufficient validation in path handling allows a WebDAV author whose write access was intended to be confined to content resources to instead reach into and tamper with these trusted internal property databases. Because httpd worker children parse and trust those databases, a malformed or attacker-controlled entry can destabilize the child process. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_http_server up to and including 2.4.67.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade immediately per the Apache advisory at https://httpd.apache.org/security/vulnerabilities_24.html and cross-referenced at https://nvd.nist.gov/vuln/detail/CVE-2026-42535 and https://seclists.org/oss-sec/2026/q2/837. If patching cannot be performed immediately, disable WebDAV by unloading mod_dav and mod_dav_fs (comment out the LoadModule directives) on servers that do not require it, which eliminates the attack surface but breaks any DAV-based publishing workflow. Where WebDAV must remain enabled, restrict <Location> blocks that include 'Dav On' to authenticated users via AuthType/Require directives and constrain DavLockDB to a path that is unreachable from any client-writable URL space, accepting that misconfigured clients may lose write access until ACLs are reviewed. Network-layer controls (firewalling DAV ports, blocking PROPPATCH/PUT/MOVE/COPY at a reverse proxy) can further reduce exposure at the cost of disabling legitimate DAV clients.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t
CVE-2026-44185 HIGH
7.3 Jun 08

Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limi

Same weakness CWE-668 – Exposure of Resource to Wrong Sphere

View all
CVE-2021-46354 HIGH POC
7.5
CVE-2017-0215 MEDIUM
5.3
CVE-2026-45411 CRITICAL POC
9.8
CVE-2023-45911 CRITICAL POC
9.8
CVE-2020-10271 CRITICAL POC
9.8
CVE-2020-10867 CRITICAL POC
9.8
CVE-2019-19015 CRITICAL POC
9.8
CVE-2018-7072 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-42535 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy