{"id":"CVE-2026-93546","published":"2026-10-01T17:17:33.313","lastModified":"2026-10-05T16:05:53.007","description":"Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-190"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/30","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw involves an integer overflow in the mod_dav_fs module of Apache HTTP Server versions up to 2.4.68, allowing authenticated users with write access to crash worker processes and corrupt directory property databases through malicious PROPPATCH requests.","exploitability":"Exploitation requires write access and knowledge of the affected version. It is moderately hard to exploit.","blast_radius":"If exploited, this can lead to service disruption and data corruption, impacting the availability and integrity of the web server.","remediation":"Upgrade to Apache HTTP Server 2.4.69 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","auth","crash","corruption"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:53:07.967Z"}}