The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Sep 16, 2004 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Sep 16, 2004 |
| Freebsd | — | Upgrade mod_davUpgrade apache | Dec 10, 2025 | Sep 15, 2004 |
| Gentoo Linux | — | Upgrade www-servers/apache.Upgrade net-www/mod_dav. | Oct 30, 2017 | Sep 16, 2004 |
| Suse | — | Upgrade apache2-example-pagesUpgrade apache2-docUpgrade apache2-preforkUpgrade mod_davUpgrade libapr0Upgrade apache2-develUpgrade apache2Upgrade apache2-worker | Dec 12, 2013 | Sep 16, 2004 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub