Apache HTTP Server EUVD-2026-90910

Exploitation requires that mod_dav/mod_dav_fs (WebDAV) is enabled AND that the directory is configured to allow write access, AND that the attacker is an authenticated WebDAV client holding write permission to the target directory (per the Apache description). The trigger is a PROPPATCH request declaring a large number of XML namespaces. Limiting factors: the WebDAV write feature is not enabled in default Apache installations, valid write credentials are needed, and the impact is confined to crashing worker processes and corrupting that directory's property database - there is no code execution, privilege escalation, or data disclosure. Affects Apache HTTP Server through 2.4.68.

No CVSS score, EPSS probability, KEV listing, or public POC is present in the provided data, so most quantitative exploitation signals are absent and the assessment relies on the Apache advisory description and CWE-190. Based on my own analysis, this is a moderate-severity integer overflow (CWE-190) whose impact is split between availability (worker-process crash) and integrity (persistent corruption of a directory's WebDAV property database) - notably it does NOT yield code execution or data disclosure, so despite being in ubiquitous software it is not a top-tier emergency. Critically, exploitation is gated: the description states an attacker must be an authenticated WebDAV client with write access, meaning the mod_dav_fs/WebDAV feature must be enabled AND the attacker must already hold write credentials, which sharply narrows the realistic attacker population versus a remote-unauthenticated flaw. The product (Apache HTTP Server) is ubiquitous, but the vulnerable configuration (WebDAV write enabled) is far less common, so this is best prioritized as a 'patch in normal cycle' DoS/integrity bug rather than a drop-everything issue - unless WebDAV write access is exposed to untrusted users. Caveat: no CVSS vector was supplied, so the AV/PR characterization here is inferred from the description, not confirmed by NVD or the vendor.

An attacker who already holds WebDAV write credentials on an Apache server with mod_dav_fs enabled sends a crafted PROPPATCH request declaring a very large number of XML namespaces, triggering an integer overflow. This crashes the handling worker process and persistently corrupts the property database for the targeted directory, degrading availability and potentially requiring manual repair. No public exploit code is identified at time of analysis.