Integer Overflow Vulnerability in Apache HTTP Server (CVE-2026-93546)
Summary
DEBIAN-CVE-2026-93546: Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH... Affects apache2 versions 2.4.57-2 – 2.4.69-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content. It supports various protocols, including HTTP and WebDAV, allowing for advanced functionalities such as file management over the web. The server is known for its flexibility, security features, and extensive community support. However, it is susceptible to vulnerabilities that can compromise its stability and security, such as the integer overflow issue identified in CVE-2026-93546.
Vulnerability Detail
The vulnerability arises from an integer overflow in the mod_dav_fs module of Apache HTTP Server versions up to 2.4.68. This flaw allows an authenticated WebDAV client with write access to send PROPPATCH requests that declare an excessive number of XML namespaces. As a result, this can lead to the crashing of worker processes and persistent corruption of the directory's property database, potentially disrupting service and compromising data integrity.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, it is essential to update the Apache HTTP Server to a patched version. Users should upgrade to version 2.4.69 or later, where this issue has been addressed. The update can typically be performed using the package manager with the following command:
sudo apt-get update && sudo apt-get install apache2'.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict write access for WebDAV clients until the server can be updated to a secure version. This can be done by modifying the server configuration to limit permissions for specific users or groups.
Conclusion
The integer overflow vulnerability in Apache HTTP Server (CVE-2026-93546) poses a significant risk to users, particularly those utilizing WebDAV functionalities. It is crucial to update to the latest version to ensure the security and stability of the server. Temporary workarounds can help mitigate risks until a full update can be performed.
See every vulnerability recorded for apache2 →
FAQ
CVE-2026-93546 is a vulnerability in Apache HTTP Server that allows an authenticated WebDAV client to crash worker processes and corrupt a directory's property database due to an integer overflow.
The vulnerability has a CVSS score of 8.8, indicating a high severity level that could lead to significant disruptions and data integrity issues.
Any user of Apache HTTP Server versions up to 2.4.68 that utilizes the mod_dav_fs module with WebDAV write access is at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, restrict write access for WebDAV clients as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.