CVE-2026-93546

A flaw was found in httpd. An integer overflow in the mod_dav_fs module occurs when processing Web Distributed Authoring and Versioning (WebDAV) PROPPATCH requests that declare an excessive number of XML namespaces. An authenticated remote attacker with write access can exploit this flaw to crash server worker processes, causing a Denial of Service (DoS), and persistently corrupt the directory's property database.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If WebDAV capabilities are not required, disable the mod_dav_fs module:

1. Comment out the dav_fs_module directive in /etc/httpd/conf.modules.d/00-dav.conf:

#LoadModule dav_fs_module modules/mod_dav_fs.so

Alternatively, if WebDAV is required but property modifications can be restricted, block the PROPPATCH method in the affected <Directory> or <Location> configuration block:

<Location "/webdav">
    <Limit PROPPATCH>
        Require all denied
    </Limit>
</Location>

2. Apply the configuration changes:

systemctl reload httpd

Caveats: Disabling mod_dav_fs disables file-backed WebDAV shares across the server. Blocking PROPPATCH prevents clients from manipulating WebDAV dead properties.

Warning: Reloading or restarting the httpd service will temporarily impact active client connections.