CVE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

CVE-2026-93546

An integer overflow vulnerability exists in the mod_dav_fs module of Apache HTTP Server (versions through 2.4.68). This flaw allows an authenticated WebDAV client with write access to trigger a crash of worker processes and cause persistent corruption of a directory's property database. The issue...

expat2 -- Fix extraction of namespace prefixes from XML names

expat project reports: Fix heap overflow triggered by XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber, and deny internal entities closing the doctype...