Skip to main content

Apache HTTP Server CVE-2026-34032

| EUVDEUVD-2026-26953 MEDIUM
Improper Null Termination (CWE-170)
2026-05-04 apache
Buffer Overflow Apache Red Hat Suse Apache Http Server Apache HTTP Server Apache Software Foundation
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
8.2 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
May 04, 2026 - 16:30 vuln.today
CVSS changed
May 04, 2026 - 14:22 NVD
5.3 (MEDIUM)
EUVD ID Assigned
May 04, 2026 - 13:45 euvd
EUVD-2026-26953
Analysis Generated
May 04, 2026 - 13:45 vuln.today
CVE Published
May 04, 2026 - 12:54 nvd
MEDIUM 5.3

DescriptionCVE.org

Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

AnalysisAI

Improper null termination and out-of-bounds read vulnerability in Apache HTTP Server through version 2.4.66 allows remote unauthenticated attackers to trigger information disclosure with low complexity exploitation. The vulnerability has a CVSS score of 5.3 (medium) with network-accessible attack vector and no user interaction required, though technical impact is limited to confidentiality (partial information disclosure). Vendor-released patch: version 2.4.67 addresses the issue.

Technical ContextAI

The vulnerability exists in Apache HTTP Server's memory handling routines where improper null termination of string data combined with an out-of-bounds read condition (CWE-170) allows attackers to read adjacent memory regions. This is a classic buffer handling flaw where a missing null terminator or incorrect bounds checking in string operations permits an attacker to access memory beyond the intended allocation. The affected CPE cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:* covers all variants and configurations of the Apache HTTP Server product line through 2.4.66.

RemediationAI

Upgrade Apache HTTP Server to version 2.4.67 or later immediately. Users unable to upgrade immediately should apply the fix from the Apache security advisories at https://httpd.apache.org/security/vulnerabilities_24.html. No workarounds to prevent the memory read are documented; compensating controls are limited to network-level mitigations such as restricting access to the server via firewall rules to trusted clients only, reducing the attack surface if the vulnerability is leveraged for reconnaissance. However, network restriction alone does not fix the underlying flaw and should be considered temporary only. Apply the patch at the earliest maintenance window to completely remediate the issue.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t

Same weakness CWE-170 – Improper Null Termination

View all
CVE-2021-22931 CRITICAL POC
9.8
CVE-2019-11044 HIGH POC
7.5
CVE-2019-11045 MEDIUM POC
5.9
CVE-2022-47515 HIGH POC
7.5
CVE-2021-1411 CRITICAL
9.9
CVE-2026-5067 CRITICAL
9.8
CVE-2026-8721 CRITICAL
9.8
CVE-2021-31886 CRITICAL
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-34032 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy