Severity context: why CVE-2026-42528 sits below the 2.4.69 headline flaws
Overview
Apache HTTP Server 2.4.69, published on 1 October 2026, carries twenty security fixes.
CVE-2026-42528 is a WebDAV availability defect in that batch, and the release summary does
not assign it the highest severity in the group. Understanding where it sits prevents both
under-reaction and panic.
The summary reports no exploitation in the wild and no public proof-of-concept for the
batch.
Mechanism and exploitation conditions
CVE-2026-42528 affects mod_dav. A caller with WebDAV lock rights can crash child
processes. The advisory applies this class of defect to versions 2.4.0 through 2.4.68.
The conditions are a loaded WebDAV module and a caller with lock rights, which an
unauthenticated mount grants to anyone who can reach it.
Impact
Availability is the affected property. The parent process replaces crashed children, so the
noticeable effect comes from repetition, not from a single request. Code execution and file
access are outside this defect.
Affected products and scope
The 2.4.0 to 2.4.68 range applies to this class of defect. The advisory also notes that a
few of the twenty issues affect narrower ranges, so each entry deserves its own reading.
Exposure context
A ZoomEye search for app="Apache httpd" returns 596,483,702 assets. The count describes
the product footprint and does not measure exposure to this CVE.
Remediation and mitigations
Apply Apache HTTP Server 2.4.69. While that is pending, unload mod_dav on hosts without
WebDAV, require authentication where WebDAV runs, and track vendor backports.
