CVE-2026-42528

A flaw was found in the mod_dav module of the Apache HTTP Server. This vulnerability allows a Denial of Service (DoS) by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning (WebDAV) locks can trigger a memory calculation error during lock operations, terminating active server processes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If WebDAV functionality is not required, disable the mod_dav module by commenting out the LoadModule dav_module line in /etc/httpd/conf.modules.d/00-dav.conf or setting Dav Off within the relevant configuration contexts.

If WebDAV is required, restrict lock capabilities to authenticated and trusted clients by limiting the LOCK method within the configuration (for example, using <Limit LOCK> blocks with strict Require directives).

Apply configuration changes by reloading the service:

systemctl reload httpd

Warning: Disabling mod_dav or restricting lock operations will prevent WebDAV clients from acquiring shared or exclusive resource locks. Reloading the httpd service may briefly affect active HTTP connections.