Apache HTTP Server EUVD-2026-35090

The target Apache HTTP Server (≤2.4.67) must have mod_dav and mod_dav_fs loaded and a Location/Directory configured with 'Dav On' so that WebDAV methods (PUT, PROPPATCH, MOVE, COPY) are accepted on a reachable URL. The CVSS vector lists PR:N, but the description constrains exploitation to a 'WebDAV content author' - i.e., an actor with write access to the DAV resource tree, which in typical hardened deployments requires successful authentication; truly anonymous-writable DAV shares would match the PR:N reading. No user interaction is required (UI:N), the attack is remote over HTTP/HTTPS (AV:N) with low complexity (AC:L), and impact is limited to integrity of DAV property stores and availability via child process crashes (C:N/I:H/A:H, scope unchanged).

Risk signals are mixed but lean toward prioritized patching for any host actually running mod_dav_fs. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H) and SSVC framing (Automatable: yes, Technical Impact: total) suggest high theoretical severity and machine-scriptable exploitation, but SSVC Exploitation is rated 'none' and the CVE is not in CISA KEV, with no public exploit identified at time of analysis and no EPSS score provided in the input. There is also tension between PR:N in the CVSS vector and the description's reference to a 'WebDAV content author,' which implies that some level of WebDAV write authorization is normally a prerequisite - defenders should verify with the Apache advisory whether truly anonymous WebDAV deployments are exposed or whether typical configurations gate this behind authentication. The 'Information Disclosure' tag conflicts with the CVSS C:N (no confidentiality impact) - treat the tag as imprecise and rely on the vector, which emphasizes integrity and availability.

A user holding write privileges on a WebDAV-enabled location crafts a request whose target path is interpreted by mod_dav_fs as resolving into the internal DAV property database file rather than a normal content resource, and writes corrupting data into it. On subsequent property reads, the httpd child process attempting to parse the tampered database crashes, producing repeated worker terminations and degrading service availability; integrity of stored WebDAV properties is also compromised. No public exploit identified at time of analysis.