CVE-2026-34355: Apache HTTP Server mod_proxy_html Buffer Overflow (DoS)

Technical summary

CVE-2026-34355 is a stack or heap buffer overflow (CWE-120, CWE-122) in Apache HTTP Server's mod_proxy_html module. The module processes HTML content proxied from backend servers without sufficient bounds checking. A malicious or compromised backend can send specially crafted content that overflows a fixed-size buffer, triggering a crash. The CVSS 3.1 score of 7.5 reflects high availability impact with no confidentiality or integrity compromise. Attack complexity is low and no authentication is required.

Business impact

The denial-of-service impact means affected web servers become temporarily unavailable when exploited. For organizations relying on Apache to front-end backend services or reverse-proxy applications, this vulnerability can interrupt service availability. Downtime affects both external users and internal systems depending on backend. The ease of exploitation (no authentication required) makes this a practical concern for any exposed Apache instance using mod_proxy_html.

Affected systems

Apache HTTP Server 2.4.67 and earlier versions are affected. This includes all 2.4.x releases up to and including 2.4.67, plus earlier major versions if they contain mod_proxy_html. Organizations using Apache in reverse-proxy or content-transformation roles are at highest risk. The vulnerability does not affect web servers that do not load or use the mod_proxy_html module.

Exploitability

Exploitation is straightforward from a network perspective: no authentication, no user interaction, and low attack complexity. However, the attacker must control or compromise the backend server that Apache proxies to. This limits exploitation to scenarios where the backend is untrusted, misconfigured, or already compromised. For internal reverse-proxy setups with untrusted upstream sources, the risk is immediate.

Remediation

Upgrade Apache HTTP Server to version 2.4.68 or later, which contains the fix. Organizations unable to upgrade immediately should disable mod_proxy_html if it is not essential, or restrict backend connections to trusted sources only. Review firewall and network rules to minimize exposure to untrusted backend servers.

Patch guidance

Verify the availability of Apache HTTP Server 2.4.68 or later from the official Apache project repository or your system vendor. Test the upgrade in a non-production environment first to ensure compatibility with existing proxy configurations and modules. Most distributions will provide updated packages; use your package manager (apt, yum, etc.) to deploy. After upgrading, restart Apache and verify that proxy_html operations continue as expected.

Detection guidance

Monitor Apache error and access logs for unexpected crashes or server restarts coinciding with specific backend requests. Abnormal HTML content in proxy requests—especially binary or non-UTF8 data—may indicate an attack attempt. Network-based detection is difficult without deep packet inspection into proxied content. Enable detailed logging of mod_proxy_html if available, and consider segmenting backend networks to reduce attack surface.

Why prioritize this

High CVSS score (7.5) combined with low attack complexity and the prevalence of Apache in production environments warrant prompt attention. Although exploitation requires a malicious backend, supply-chain risks and internal compromises are realistic. Organizations with internet-facing reverse proxies pointing to untrusted or third-party backends should prioritize this immediately; those with strictly internal, trusted backend connections can schedule updates within standard maintenance windows.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects complete availability loss (denial of service) with no confidentiality or integrity impact. Network accessibility and low attack complexity increase the base score. The requirement for an attacker to control the backend limits real-world exploitation frequency but does not reduce the technical severity of the vulnerability itself.

Frequently asked questions