Skip to main content

Apache HTTP Server CVE-2026-44186

| EUVDEUVD-2026-35088 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-06-08 apache GHSA-6cr8-qx2w-7743
Denial Of Service Apache Red Hat Apache Http Server Apache Software Foundation
7.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE
MEDIUM
qualitative
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Jun 09, 2026 - 14:22 vuln.today
CVSS changed
Jun 09, 2026 - 14:22 NVD
7.3 (HIGH)
CVE Published
Jun 08, 2026 - 15:11 nvd
HIGH 7.3
CVE Published
Jun 08, 2026 - 15:11 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

AnalysisAI

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from an infinite loop condition in the mod_proxy_ftp module when interacting with an attacker-controlled backend FTP server. Remote attackers can degrade availability and partially impact confidentiality and integrity without authentication, though exploitation requires a proxied request path to a malicious FTP backend. No public exploit identified at time of analysis, and EPSS is very low at 0.02%.

Technical ContextAI

Apache HTTP Server's mod_proxy_ftp module implements an FTP gateway within the broader mod_proxy reverse/forward proxy framework, translating HTTP requests into FTP commands and parsing FTP responses back to HTTP clients. The vulnerability is a CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop) defect in how mod_proxy_ftp processes responses from the upstream FTP server: a malicious or malformed reply pattern fails to satisfy the loop's termination predicate, causing the httpd worker to spin indefinitely. Because httpd typically handles requests per-process or per-thread, a single stuck worker consumes a connection slot, and repeated exploitation can exhaust the MPM worker pool. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_http_server covering versions 2.4.0 through 2.4.67, with the fix landing in 2.4.68.

RemediationAI

Vendor-released patch: Apache HTTP Server 2.4.68 - upgrade from any 2.4.0-2.4.67 release per the Apache advisory at https://httpd.apache.org/security/vulnerabilities_24.html. If immediate upgrade is not feasible, the most effective compensating control is to disable mod_proxy_ftp by removing or commenting its LoadModule directive (this breaks any legitimate HTTP-to-FTP gateway functionality but eliminates the attack surface entirely). Alternatively, restrict ProxyPass and ProxyPassMatch rules so they never target attacker-influenced ftp:// URLs, and use ProxyBlock or upstream firewalling to constrain which FTP backends mod_proxy_ftp may contact - the trade-off is operational rigidity and the need to maintain an allowlist of trusted FTP servers. Rate-limiting and per-IP connection caps via mod_reqtimeout or mod_qos can blunt worker-pool exhaustion but do not address the root infinite loop.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-48913 HIGH
7.3 Jun 08

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to t

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-44186 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy