oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Tue, 5 May 2026 20:27:25 +0200 On Mon, May 04, 2026 at 02:15:25PM +0000, Eric Covener wrote: Severity: low Affected versions: - Apache HTTP Server through 2.4.66 Description: A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs.
