Skip to main content

Apache HTTP Server CVE-2026-34355

| EUVDEUVD-2026-35097 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-08 apache GHSA-3qgf-pp84-379f
Buffer Overflow Apache Heap Overflow Apache Http Server Apache Software Foundation
7.5
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Apache reverse proxy with mod_proxy_html
  2. Delivery
    Gain control of or influence over upstream backend
  3. Exploit
    Return crafted HTML response
  4. Execution
    Trigger heap overflow in proxy_html filter
  5. Persist
    Crash httpd worker process
  6. Impact
    Denial of service for proxied vhost

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Apache HTTP Server 2.4.0-2.4.67 must be running with mod_proxy_html loaded and ProxyHTMLEnable active on the request path, configured as a reverse proxy (ProxyPass / ProxyPassReverse) to a backend that the attacker either controls outright or can influence into returning crafted HTML - the description names 'an untrusted backend' as the exploitation vector. No client-side authentication or user interaction against the Apache front-end is required (PR:N/UI:N), but exploitation is gated by (1) the proxy_html module actually being enabled (non-default for many deployments), (2) the affected vhost proxying to an attacker-reachable or attacker-controlled origin, and (3) the response being processed through the HTML rewriting filter rather than being passed through verbatim. Impact is limited to availability (A:H, C:N, I:N), so this condition set yields DoS rather than code execution.
Impact

Signals are mixed and warrant context: CVSS 7.5 is driven entirely by A:H (availability), with C:N and I:N - so this is a crash/DoS-class bug, not RCE, despite CWE-122 being a memory-corruption class that can sometimes escalate. The attack vector is network and unauthenticated (AV:N/AC:L/PR:N/UI:N), but exploitation requires that the Apache instance be configured as a reverse proxy with mod_proxy_html enabled AND that the attacker control or compromise the backend origin - the description explicitly states 'an attack by an untrusted backend.' This sharply limits realistic exposure to deployments fronting third-party or attacker-influenceable upstreams. The CVE is not on CISA KEV, no EPSS score was supplied, no SSVC decision was supplied, and no public exploit was identified at time of analysis, so prioritization should be patch-on-next-cycle rather than emergency unless the affected deployment proxies untrusted backends.
Exploit ScenarioDerived

An attacker who controls or compromises a backend application server sitting behind an Apache reverse proxy returns a crafted HTML response that triggers the heap overflow inside mod_proxy_html as Apache rewrites links in the body, causing the worker process to crash and resulting in denial of service for clients of that vhost. The same scenario applies when Apache is configured to proxy to a third-party origin the attacker can influence (e.g., a mashup gateway or a partner-hosted service). No public PoC was identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html output filter, where a malicious or compromised backend can return crafted HTML that corrupts memory in the proxying httpd worker. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network exploitation with availability-only impact, and no public exploit was identified at time of analysis.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade httpd to 2.4.68 or later, which the vendor states fixes this issue, per https://httpd.apache.org/security/vulnerabilities_24.html. If immediate upgrade is not feasible, disable the output filter by removing 'LoadModule proxy_html_module' (or commenting it out) and removing ProxyHTMLEnable/ProxyHTMLURLMap directives from vhost configs; the side effect is that internal URLs in proxied HTML responses will no longer be rewritten, which can break links exposed to external clients. As a narrower compensating control, restrict ProxyPass targets to fully trusted, controlled origins (no public APIs, no user-controllable upstreams) so that an attacker cannot supply the malicious HTML body the filter parses. Monitoring httpd worker crashes and segfaults via mod_status or systemd journal can help detect exploitation attempts in the interim.

Affected VersionsENISA

Apache HTTP Server 2.4.0 ≤2.4.67

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

mod_proxy_html is an Apache output filter (originally by Nick Kew, bundled with httpd since 2.4) that rewrites HTML links in responses traversing a reverse proxy so that internal URLs are rewritten for external clients. It parses and serializes HTML using libxml2 while applying ProxyHTMLURLMap rules. The CWE-122 classification (heap-based buffer overflow) indicates that data sourced from the backend HTTP response is written past the bounds of a heap-allocated buffer inside this filter, consistent with a parser or rewriting routine mis-sizing output during transformation. The affected component is identified in CPE as cpe:2.3:a:apache_software_foundation:apache_http_server, scoped to versions up to and including 2.4.67.

Know when Apache Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jun 08, 2026 - 19:22 NVD
7.5 (HIGH)
CVE Published
Jun 08, 2026 - 15:20 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 08, 2026 - 15:20 nvd
HIGH 7.5

DescriptionCVE.org

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

Executive ViewAI

Why It Matters

Apache HTTP Server versions 2.4.0 through 2.4.67 contain a denial-of-service vulnerability in the mod_proxy_html filter allowing unauthenticated remote attackers to crash worker processes through crafted backend responses; no public exploit identified at time of analysis. No vendor-released patch has been identified. Organizations operating Apache as reverse proxies face service availability risk, requiring immediate compensating controls to maintain business continuity for production environments.

Business Impact: High
Compensating Controls

Disable mod_proxy_html module if functionally feasible; segment network to restrict backend-to-proxy communication; implement rate-limiting on proxy ingress; deploy automated worker process health monitoring and restart capabilities; enable detailed logging of mod_proxy_html activity to detect exploitation attempts; establish failover to alternative load-balancing infrastructure if available.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-93546 HIGH
8.8 Oct 01

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client

CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-63292 HIGH
7.5 Oct 01

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
CVE-2026-59685 HIGH
7.5 Oct 01

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34355 ADVISORY https://seclists.org/oss-sec/2026/q2/835 ADVISORY https://ubuntu.com/security/notices/USN-8516-1 ADVISORY https://vuldb.com/vuln/369200 REF http://www.openwall.com/lists/oss-security/2026/06/08/6 REF https://access.redhat.com/errata/RHSA-2026:25042 REF https://access.redhat.com/errata/RHSA-2026:34109 REF https://access.redhat.com/errata/RHSA-2026:41906 REF https://access.redhat.com/errata/RHSA-2026:42828 REF https://access.redhat.com/errata/RHSA-2026:47046 REF https://access.redhat.com/errata/RHSA-2026:53371 REF https://access.redhat.com/errata/RHSA-2026:56868 REF https://access.redhat.com/errata/RHSA-2026:56869 REF https://access.redhat.com/errata/RHSA-2026:62165 REF https://access.redhat.com/errata/RHSA-2026:66323 REF https://access.redhat.com/errata/RHSA-2026:67152 REF https://access.redhat.com/security/cve/CVE-2026-34355 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486414 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34355.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy