A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://httpd.apache.org/security/vulnerabilities_24.html | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/08/8 | Mailing List Third Party Advisory |
Configurations
History
09 Jun 2026, 16:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | |
| First Time |
Apache http Server
Apache |
|
| References | () https://httpd.apache.org/security/vulnerabilities_24.html - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/08/8 - Mailing List, Third Party Advisory |
09 Jun 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
08 Jun 2026, 23:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-08 16:16
Updated : 2026-06-09 16:00
NVD link : CVE-2026-42535
Mitre link : CVE-2026-42535
CVE.ORG link : CVE-2026-42535
JSON object : View
Products Affected
apache
- http_server
CWE
CWE-668
Exposure of Resource to Wrong Sphere