CVE-2026-42535 Apache HTTP Server: mod_dav_fs protected directory access

🗓️ 08 Jun 2026 15:14:49Reported by apacheType

CVE-2026-42535: Apache mod_dav_fs path handling lets WebDAV authors modify trusted property databases, risking crashes; upgrade to 2.4.68.

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server	16 Jun 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	23 Jun 202616:13	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	8 Jun 202600:00	–	freebsd
ATTACKERKB	CVE-2026-42535	8 Jun 202615:14	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2026-1880)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd, --advisory ALAS2-2026-3379 (ALAS-2026-3379)	22 Jun 202600:00	–	nessus
Tenable Nessus	Apache 2.4.x < 2.4.68 Multiple Vulnerabilities	8 Jun 202600:00	–	nessus
Tenable Nessus	Debian dla-4629 : apache2 - security update	12 Jun 202600:00	–	nessus
Tenable Nessus	FreeBSD : Apache httpd -- Multiple vulnerabilities (7655baae-637d-11f1-8607-8447094a420f)	9 Jun 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-42535	9 Jun 202600:00	–	nessus

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.67",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
httpd	www.httpd.apache.org/security/vulnerabilities_24.html

08 Jun 2026 15:14Current

EPSS0.00538

CWE-668