AZL-89738 CVE-2026-42535 affecting package httpd for versions less than 2.4.68-1

🗓️ 08 Jun 2026 16:16:39Reported by GoogleType

osv🔗 osv.dev👁 8 Views

Path handling in mod_dav_fs allows WebDAV authors to crash child processes in Apache 2.4.67.

Reporter	Title	Published	Views	Family All 132
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase	25 Aug 202609:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server	16 Jun 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in IBM HTTP Server used by IBM Rational ClearQuest	23 Jul 202619:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.	21 Jul 202617:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	23 Jun 202616:13	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	8 Jun 202600:00	–	freebsd
attackerkb	CVE-2026-42535	8 Jun 202615:14	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2026-1880)	22 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd, --advisory ALAS2-2026-3379 (ALAS-2026-3379)	22 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : httpd (ALSA-2026:41906)	21 Jul 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42535

28 Aug 2026 17:47Current

7.1High risk

Vulners AI Score7.1

EPSS0.0071

SSVC

Apache httpd mod_dav_fs path handling child process crash WebDAV