PT-2026-103943

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description An integer overflow exists in the mod dav fs module. An authenticated WebDAV client with write access can trigger this issue by sending PROPPATCH requests that declare an excessive number...

PT-2026-103923

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.4.0 through 2.4.67 Description A memory calculation bug in the mod dav module allows an attacker with permissions to create WebDAV locks to crash server child processes. Approximately 596.5 million instances are...

TencentOS Server 3: httpd:2.4 (TSSA-2026:0732)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0732 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

ROS-20260715-73-0008

The vulnerability of the moddavlock module in the Apache HTTP Server is related to pointer dereferencing. Exploiting this vulnerability could allow a remote attacker to cause a denial-of-service attack...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-2653)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data. This issue affects Apache...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-2693)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data. This issue affects Apache...

httpd: NULL pointer dereference via specially crafted request

A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request...

CVE-2026-42535

A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

CVE-2026-42535

A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

CVE-2026-42535

A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Updated apache packages fix security vulnerabilities

http2: double free and possible RCE on early reset. CVE-2026-23918 modrewrite elevation of privileges via apexpr. CVE-2026-24072 buffer overflow in modproxyajp via ajpmsgcheckheader. CVE-2026-28780 modmd unrestricted OCSP response. CVE-2026-29168 moddavlock indirect lock crash. CVE-2026-29169...

CVE-2026-29169

A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request. Mitigation Disabling moddavlock and restarting httpd will mitigate this flaw...

Apache HTTP Server: mod_dav_lock indirect lock crash

...

PT-2026-37663

A NULL pointer dereference in mod dav lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod dav lock is not used internally by mod dav or mod dav fs. The only known use-case for mod dav lock was mod dav svn from Apache Subversion...

SUSE CVE-2026-29169

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than...

The vulnerability of the Apache HTTP Server’s web server, related to the splitting of HTTP requests, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the moddavlock module in the Apache HTTP Server is related to pointer dereferencing. Exploiting this vulnerability could allow a remote attacker to cause a denial-of-service attack...

ALPINE-CVE-2026-29169

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than...

CVE-2026-29169

A NULL pointer dereference vulnerability exists in the mod_dav_lock module of the Apache HTTP Server (version 2.4.66 and earlier). A remote attacker can exploit this by sending a malicious request to trigger a denial-of-service (DoS) attack, causing the server to crash. Notably, mod_dav_lock is n...

CVE-2026-29169

A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than...

Apache HTTP Server 代码问题漏洞

Apache HTTP Server is an open-source web server developed by the Apache Foundation in the United States. This server is known for its speed, reliability, and ability to be expanded through simple APIs. Versions of Apache HTTP Server 2.4.66 and earlier have code vulnerabilities due to a null point...