CVE-2026-42528
Apache Http Server: denial of service
- Risk score
- 43/100
- CVSS
- 4.3 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
- Affected
- Apache Http Server before 2.4.69
- Fix
- Upgrade Apache Http Server to 2.4.69 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Http Server: Red, act today. Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
The flaws
- CVE-2026-42528: Denial of service (CVSS 4.3 · EPSS 0%)
- CVE-2026-57941: Use-after-free (CVSS 9.8 · EPSS 1%)
- CVE-2026-56154: Use-after-free (CVSS 9.8 · EPSS 1%)
- CVE-2026-59797: Privilege escalation (CVSS 9.8 · EPSS 1%)
The fix
Upgrade Apache Http Server: 2.4.69 or later on your release line
Who is exposed: Apache Http Server
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-789 (CWE-789). 45 other warnings in 30 days
- Same product: Earlier Apache Http Server warnings. 16 in the last 90 days
Why it is Yellow
- CVSS 4.3 medium
- On your watchlist: apache http server
References
Original description
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
Last activity 1 Oct 2026. Patch Forecast updates every hour.