A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.
Users are recommended to upgrade to version 2.4.69, which fixes this issue
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade mod_proxy_htmlUpgrade httpd-toolsUpgrade httpd-develUpgrade httpdUpgrade mod_sslUpgrade mod_mdUpgrade httpd-debuginfoUpgrade httpd-manualUpgrade mod_ldapUpgrade mod_http2Upgrade httpd-filesystemUpgrade mod_session | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade httpd-debugsourceUpgrade mod_proxy_htmlUpgrade httpd-toolsUpgrade httpd-coreUpgrade httpd-manualUpgrade mod_ldap-debuginfoUpgrade mod_http2Upgrade httpd-core-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade mod_http2-debuginfoUpgrade httpd-filesystemUpgrade httpdUpgrade mod_luaUpgrade httpd-develUpgrade mod_lua-debuginfoUpgrade mod_session-debuginfoUpgrade mod_ldapUpgrade mod_sessionUpgrade httpd-tools-debuginfoUpgrade mod_sslUpgrade httpd-debuginfoUpgrade mod_ssl-debuginfo | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Redhat_linux | — | No solution exists | Oct 5, 2026 | Oct 1, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Oct 1, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub