Apache HTTP Server EUVD-2026-90885

Exploitation requires the mod_dav WebDAV module to be loaded and enabled, and the attacker must hold an account with permission to create WebDAV locks (consistent with PR:L) - this is not reachable against a default Apache install, which does not enable WebDAV. The limiting factors are significant: no anonymous access (authenticated lock-creation privilege required), impact confined to crashing child processes (availability only, no data exposure or code execution), and dependence on a non-default server configuration where WebDAV with lock support is deployed. Servers without mod_dav enabled are not affected.

This is a genuine but low-urgency issue, best characterized as a high-visibility-product but modest-impact flaw rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) scores availability-only impact with no confidentiality or integrity loss, and crucially requires PR:L - the attacker must already hold permission to create WebDAV locks, so this is authenticated abuse, not anonymous exploitation. CISA's SSVC framing agrees it is low priority: Exploitation=none, Automatable=no, Technical Impact=partial. There is no public exploit and no KEV listing (no public exploit identified at time of analysis), and no EPSS score was supplied so widespread-exploitation probability cannot be quantified from the input. All signals are consistent and point the same direction - a real, patchable denial-of-service bug limited to crashing child processes, reachable only by users already trusted to write WebDAV locks. Note one input discrepancy: the description says 'httpd 2.4.67 and earlier' while the EUVD affected-version field says '≤2.4.68' - verify the exact last-affected version against the vendor advisory before gating remediation.

An attacker who already has credentials permitting WebDAV lock creation sends a crafted LOCK request to a mod_dav-enabled Apache httpd instance, triggering a faulty memory-size calculation (CWE-789) that crashes the handling child process. Repeating this degrades or denies service to other users. No public exploit code is known, and the attack cannot proceed without valid lock-creation permission.