mod_dav_fs flaw may corrupt WebDAV data
The advisory published by oss-sec on October 1, 2026 describes a moderate flaw in Apache HTTP Server through version 2.4.68, exploitable by authenticated WebDAV clients with write access.
Source: CVE-2026-93546: Apache HTTP Server — estouro de namespace em mod_dav_fs (seclists.org). Text prepared with AI from this source.
What happened and what to do
The oss-sec advisory, published on October 1, 2026, reports CVE-2026-93546, a moderate flaw in the mod_dav_fs module of Apache HTTP Server through version 2.4.68. An authenticated WebDAV client with write permission can send PROPPATCH requests declaring many XML namespaces, crash worker processes, and persistently corrupt a directory's properties database.
A company using WebDAV can inventory its servers and versions, identify mod_dav_fs instances exposed to users with write access, and monitor process failures and properties-data integrity. It can also review access controls, log relevant requests, and establish backup and recovery procedures while assessing and applying corrective measures available for its environment.
How the consultancy can help
Wendelmaques can diagnose exposure across WebDAV services, scope an implementation of inventory, monitoring, and access controls, and support their operation and data recovery.
Next step
Send a short description of your WebDAV environment and the exposure you want assessed to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.