Apache Software Foundation Apache HTTP Server mod_dav_fs integer overflow causes worker crashes and property database corruption

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

• Apache Software Foundation Apache HTTP Server: the product record has default status unaffected, but explicitly marks versions from 0 through 2.4.68 as affected.
• The Apache advisory confirms that the affected range extends through 2.4.68.
• Apache records the fix in the 2.4.x branch by revision r1938682 and identifies released update 2.4.69.
• The available evidence does not establish how every downstream package or parallel release branch maps to these upstream boundaries when a separate backport is present.

The flaw is in mod_dav_fs while Apache HTTP Server processes a PROPPATCH request containing many XML namespace declarations. An authenticated WebDAV client with write access controls the input that triggers the integer overflow. The confirmed results are worker process crashes and persistent corruption of a directory's property database. The supplied structured assessment describes a network-reachable path with no user interaction and low required privileges. The available evidence does not disclose the exact arithmetic operation, namespace threshold, allocation path, or internal property database format.

• Reachability: The attack can be delivered through a network request using PROPPATCH against a WebDAV service.
• Preconditions: The attacker must have an authenticated account and write access through WebDAV; anonymous access is not described as sufficient.
• Request characteristics: The supplied structured assessment records low attack complexity and no user interaction.
• Exploitation status: The supplied record does not mark the issue as known exploited and does not identify a public exploit. The Apache advisory and Openwall notice reviewed describe the flaw and fix but do not provide evidence of real-world exploitation. This does not prove that exploitation has never occurred.

The flaw affects both service availability and integrity: worker processes can crash, while a directory's property database can be persistently corrupted. The supplied structured assessment marks confidentiality, integrity, and availability impact as high, but the concrete technical description confirms only the crash and property database corruption outcomes. The evidence does not establish code execution, direct reading of file contents, or authentication bypass. The immediate scope is the server and directories handled by mod_dav_fs, subject to the attacker already having authenticated WebDAV write access.

• Crashed worker processes can interrupt service or reduce the capacity of an affected Apache server.
• Persistent property database corruption can undermine WebDAV metadata integrity and cause continuing errors for operations involving the affected directory.
• Service recovery may require determining the scope of the corrupted property database and restoring metadata from an appropriate backup, although the available sources do not define a recovery procedure.
• Because exploitation requires authentication and WebDAV write access, exposure depends substantially on how the organization grants permissions to WebDAV accounts and endpoints.

1. Upgrade Apache HTTP Server to released version 2.4.69, which Apache identifies as the update for this issue.
2. If Apache is supplied by an operating system or distributor, apply that provider's security update and verify that it incorporates the corresponding fix. Do not infer downstream package status from the Apache version alone.
3. Until an update is possible, consider temporarily removing WebDAV write access for accounts that do not require it or disabling the affected WebDAV deployment where operationally acceptable. This is exposure reduction inferred from the exploitation precondition, not a vendor-confirmed workaround in the available evidence.
4. After updating, verify the actual installed package or running version, restart or reload the service according to the deployment process, and recheck WebDAV endpoints and write permissions.

1. Inventory Apache HTTP Server installations and compare the running versions with the affected and fixed boundaries recorded in the affected summary.
2. Identify deployments that load or use mod_dav_fs, and review WebDAV endpoints that accept the PROPPATCH method.
3. Review WebDAV authorization, especially authenticated accounts with write access to served directories.
4. If request bodies or sufficiently detailed request metadata are retained, look for PROPPATCH requests declaring many XML namespaces. This is a precautionary review heuristic based on the documented trigger, not a vendor-confirmed IOC.
5. Check telemetry for worker process crashes or restarts and reports of property database corruption near WebDAV request activity. Absence of those records does not prove that a system is safe.