Apache HTTP Server CVE-2026-34356

Exploitation requires that the target Apache HTTP Server (2.4.0 through 2.4.67) be deployed as a reverse proxy with mod_proxy loaded and at least one ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath directive configured, and that the attacker control or have compromised a backend origin server that the proxy forwards requests to, since the malicious input is a crafted Set-Cookie response header from upstream. Limiting factors: although CVSS PR:N/UI:N indicates no proxy-side authentication or user interaction, the attacker must occupy a privileged position relative to a backend rather than simply being an internet client, and impact is restricted to availability (process crash) with no confidentiality or integrity loss per the CVSS vector.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 and accurately reflects an availability-only network-reachable bug with no authentication or user interaction, but the practical attack surface is narrower than the raw score suggests because exploitation depends on the proxy talking to an attacker-influenced backend, not arbitrary internet clients. No EPSS score was supplied in the intelligence bundle, the CVE is not in CISA KEV, and no public exploit code has been identified, so this is not a drop-everything emergency for most operators. The realistic priority is elevated for organizations whose Apache instances reverse-proxy to third-party SaaS, partner-controlled, or otherwise untrusted upstreams using ProxyPassReverseCookie* directives, and routine for deployments that only proxy to fully trusted internal backends. Confirmed signals (Apache advisory, CWE-122, fixed version) are consistent; missing signals (EPSS, POC) limit confidence in exploitation timing.

An attacker who controls or compromises a backend origin server that an Apache reverse proxy forwards traffic to returns an HTTP response containing a crafted Set-Cookie header; when Apache applies its ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath rewriting, the heap-based buffer overflow is triggered and the worker process crashes, denying service to all clients of that proxy. Repeated triggering keeps the front end in a crash-restart loop. No public exploit has been identified at time of analysis.