CVE-2026-93546: 
Apache HTTP Server Analyse et atténuation de la vulnérabilité

CVE-2026-93546 is an integer overflow vulnerability in the mod_dav_fs module of Apache HTTP Server, dubbed "mod_dav_fs namespace overflow." It affects all versions of Apache HTTP Server through 2.4.68 and was fixed in version 2.4.69, released on October 1, 2026. An authenticated WebDAV client with write access can exploit this flaw to crash worker processes and persistently corrupt a directory's property database by sending PROPPATCH requests that declare an excessive number of XML namespaces. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Openwall OSS-Sec).

The root cause is an integer overflow (CWE-190 / CAPEC-92: Forced Integer Overflow) in mod_dav_fs when processing WebDAV PROPPATCH requests. When a client submits a PROPPATCH request containing a very large number of XML namespace declarations, an arithmetic operation on the namespace count overflows the integer type used internally, leading to memory corruption in the directory's property database (typically a DBM file). Exploitation requires network access and low-level authentication (write access to a WebDAV-enabled directory), but no user interaction. The vulnerability was reported on 2026-07-28 by Zhen Kong (Calif.io) in collaboration with Anthropic, and AISLE in partnership with Red Hat, and was fixed in SVN revision r1938682 on 2026-10-01 (Openwall OSS-Sec, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker to crash Apache HTTP Server worker processes (denial of service) and permanently corrupt the WebDAV property database for affected directories, resulting in persistent data integrity loss. The CVSS scoring reflects high impacts across confidentiality, integrity, and availability, though the primary practical impact is service disruption and data corruption of WebDAV-managed directory metadata. Repeated exploitation could render WebDAV-hosted resources inaccessible and corrupt stored property data irreversibly (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.34–0.44%, placing it in roughly the 36th percentile for exploitation likelihood within 30 days. Exploitation is not automatable (per NVD SSVC assessment) as it requires authenticated write access to a WebDAV-enabled directory (Openwall OSS-Sec).

1. Reconnaissance: Identify Apache HTTP Server instances (versions ≤ 2.4.68) with WebDAV enabled and write access permitted, using tools like Shodan, Censys, or targeted HTTP OPTIONS requests to discover DAV headers.
2. Obtain credentials: Acquire valid credentials for a WebDAV account with write access to a target directory (e.g., through credential stuffing, phishing, or use of existing authorized credentials).
3. Craft malicious PROPPATCH request: Construct an HTTP PROPPATCH request targeting a WebDAV-enabled directory that includes an abnormally large number of unique XML namespace declarations in the request body (e.g., hundreds or thousands of xmlns:nsN attributes), designed to trigger the integer overflow in mod_dav_fs.
4. Send the request: Authenticate to the WebDAV endpoint and submit the crafted PROPPATCH request. Example skeleton:

PROPPATCH /webdav/target/ HTTP/1.1
Host: target.example.com
Authorization: Basic <base64creds>
Content-Type: application/xml

<?xml version="1.0"?>
<D:propertyupdate xmlns:D="DAV:"
  xmlns:ns1="urn:ns1" xmlns:ns2="urn:ns2" ... xmlns:nsN="urn:nsN">
  <D:set><D:prop><ns1:foo>bar</ns1:foo></D:prop></D:set>
</D:propertyupdate>

5. Trigger crash and corruption: The integer overflow in namespace count processing causes the worker process to crash and corrupts the directory's DBM property database, resulting in denial of service and persistent data corruption (Openwall OSS-Sec, GitHub Advisory).

• Network: Unusual or repeated HTTP PROPPATCH requests to WebDAV-enabled directories with abnormally large request bodies; requests containing hundreds or thousands of XML namespace declarations (xmlns: attributes) in a single PROPPATCH body.
• Logs: Apache access logs showing PROPPATCH requests to WebDAV paths returning 5xx errors or followed by worker process restarts; error logs showing segmentation faults or abnormal termination of httpd worker processes.
• File System: Corruption or unexpected modification timestamps on WebDAV property database files (e.g., .DAV/ directory contents, DBM files such as *.db or *.dir/*.pag pairs) in WebDAV-enabled directories.
• Process: Repeated unexpected restarts of Apache httpd worker processes; parent process spawning replacement workers in rapid succession following PROPPATCH activity.

Upgrade Apache HTTP Server to version 2.4.69 or later, which contains the fix applied in SVN revision r1938682 on October 1, 2026 (Openwall OSS-Sec, Apache Vulnerabilities). If immediate upgrade is not possible, restrict WebDAV write access (Dav On with Require directives) to only explicitly trusted and necessary users. Alternatively, disable mod_dav_fs entirely if WebDAV functionality is not required. Monitor for PROPPATCH requests with unusually large XML bodies as a detection measure. Red Hat and Amazon Linux have issued their own advisories and updated packages (Red Hat Bugzilla).

The Apache Software Foundation rated this vulnerability as "moderate" severity in their official disclosure, despite the CVSS score of 8.8 (High), noting the requirement for authenticated write access as a significant mitigating factor (Openwall OSS-Sec). Security news outlets including SecurityOnline, CyberSecurityNews, and How2Shout covered the broader Apache HTTP Server 2.4.69 release, which patched approximately 20 flaws, with commentary noting that Apache itself rated none of the issues as "important." The vulnerability was credited to researchers using AI-assisted discovery (Anthropic collaboration), which drew some community interest regarding AI-aided vulnerability research.