Vulnerability intelligence

CVE-2026-42528

Apache Software Foundation Apache HTTP Server CWE-789

A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue

CVSS Score

4.3

Medium

EPSS — Exploit Probability

—

Awaiting FIRST.org data · checked 2026-10-02

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Oct 2, 2026 · latest Oct 2, 2026

Coverage timeline

Apache Fixes 20 Flaws Including Critical mod_vhost_alias Bug
securityonline.info · Oct 2, 2026

Related CVEs — Apache Software Foundation

CVE-2026-63292 CVE-2026-57941 CVE-2026-56154 CVE-2026-59797 CVE-2026-59685 CVE-2026-42356 CVE-2026-93546 CVE-2026-94052