Is CVE-2026-93546 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93546 being exploited in the wild.

How severe is CVE-2026-93546?

High severity, with a CVSS score of 8.8, published 1 October 2026.

Which products and versions are affected?

Apache HTTP Server through 2.4.68.

Is there a fix for CVE-2026-93546?

Yes: fixed in Apache HTTP Server 2.4.69. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93546 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93546?

Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93546: Apache HTTP Server mod_dav_fs integer overflow in namespace handling

CVE-2026-93546 · Severity: high · CVSS 8.8 · Published 2026-10-01

Apache HTTP Server's WebDAV module contains an integer overflow flaw in its namespace handling code. An authenticated user with WebDAV write access can send specially crafted requests with many XML namespaces to crash worker processes and corrupt the server's property database. This can disrupt website availability and corrupt stored metadata.

Technologies: Apache HTTP Server. Vendors: Apache.

Quick answers

Is CVE-2026-93546 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93546 being exploited in the wild.
How severe is CVE-2026-93546?: High severity, with a CVSS score of 8.8, published 1 October 2026.
Which products and versions are affected?: Apache HTTP Server through 2.4.68.
Is there a fix for CVE-2026-93546?: Yes: fixed in Apache HTTP Server 2.4.69. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93546 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93546?: Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache HTTP Server 2.4.69

Technical details

An integer overflow in mod_dav_fs allows authenticated WebDAV clients to crash worker processes and corrupt directory property databases via PROPPATCH requests with excessive XML namespace declarations. The vulnerability requires authentication and WebDAV write permissions. The flaw was fixed in Apache HTTP Server 2.4.69.

Affected products

Apache HTTP Server through 2.4.68

Timeline

2026-07-28: disclosed
2026-10-01: patched: fixed in 2.4.69

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.