Skip to main content

Apache HTTP Server CVE-2026-34355

| EUVDEUVD-2026-35097 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-08 apache GHSA-3qgf-pp84-379f
Buffer Overflow Apache Heap Overflow Apache Http Server Apache Software Foundation
7.5
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 08, 2026 - 19:25 vuln.today
CVSS changed
Jun 08, 2026 - 19:22 NVD
7.5 (HIGH)
CVE Published
Jun 08, 2026 - 15:20 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 08, 2026 - 15:20 nvd
HIGH 7.5

DescriptionCVE.org

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

AnalysisAI

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html output filter, where a malicious or compromised backend can return crafted HTML that corrupts memory in the proxying httpd worker. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network exploitation with availability-only impact, and no public exploit was identified at time of analysis.

Technical ContextAI

mod_proxy_html is an Apache output filter (originally by Nick Kew, bundled with httpd since 2.4) that rewrites HTML links in responses traversing a reverse proxy so that internal URLs are rewritten for external clients. It parses and serializes HTML using libxml2 while applying ProxyHTMLURLMap rules. The CWE-122 classification (heap-based buffer overflow) indicates that data sourced from the backend HTTP response is written past the bounds of a heap-allocated buffer inside this filter, consistent with a parser or rewriting routine mis-sizing output during transformation. The affected component is identified in CPE as cpe:2.3:a:apache_software_foundation:apache_http_server, scoped to versions up to and including 2.4.67.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade httpd to 2.4.68 or later, which the vendor states fixes this issue, per https://httpd.apache.org/security/vulnerabilities_24.html. If immediate upgrade is not feasible, disable the output filter by removing 'LoadModule proxy_html_module' (or commenting it out) and removing ProxyHTMLEnable/ProxyHTMLURLMap directives from vhost configs; the side effect is that internal URLs in proxied HTML responses will no longer be rewritten, which can break links exposed to external clients. As a narrower compensating control, restrict ProxyPass targets to fully trusted, controlled origins (no public APIs, no user-controllable upstreams) so that an attacker cannot supply the malicious HTML body the filter parses. Monitoring httpd worker crashes and segfaults via mod_status or systemd journal can help detect exploitation attempts in the interim.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t
CVE-2026-44185 HIGH
7.3 Jun 08

Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limi

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-34355 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy