CVE-2026-42535

9.1 criticalEPSS 0.5%

Critical (9.1) in apache http server. EPSS 0.5% chance of exploitation in the next 30 days.

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-668
Published: 2026-06-08
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

Affected

apache:http_server

References

https://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2026/06/08/8

Check your stack JSON