Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read Web

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Debian:12 apache22.4.57-2, 2.4.57-3, 2.4.58-1
• Debian:13 apache20 → 2.4.69-1~deb13u1
• Debian:14 apache20 → 2.4.69-1

How to fix CVE-2026-58415

• Recommended remediation

  A patch or advisory reference is linked. Open the original publisher for availability by product version.

• Official advisories

  • Apache Software Foundation · httpd.apache.org
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • OpenSSF OSV / OSV Scanner · osv.dev
  • Trivy Vulnerability DB · osv.dev
  • Ubuntu Security Notices · ubuntu.com

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · Ubuntu Security Notices

   Detected

   이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. (CVE-2026-

2. Oct 16, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   apache2 fixed in 2.4.69-1~deb13u1; apache2 fixed in 2.4.69-1

3. Oct 16, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   apache2 fixed in 2.4.69-1~deb13u1

4. Oct 16, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   apache2 fixed in 2.4.69-1

5. Oct 16, 2026 · OpenSSF OSV / OSV Scanner

   Updated

   Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Sources

• Apache Software FoundationVendor advisoryCVE-2026-58415

  CVE-2026-58415 is named on the public Apache Software Foundation page.

  httpd.apache.org
• CVE.orgVulnerability recordCVE-2026-58415

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-58415

  30-day exploitation probability 0.5%

  first.org
• OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-58415
  osv.dev
• Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-58415

  Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory Thi

  osv.dev
• Ubuntu Security NoticesVendor advisoryCVE-2026-58415

  이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server res

  ubuntu.com

References

• ADVISORY · security-tracker.debian.org

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.