Apache HTTP Server CVE-2026-44186

The target Apache HTTP Server must have the mod_proxy_ftp module loaded and configured to proxy requests to an FTP backend that the attacker controls or can influence (for example, via an open ProxyPass/ProxyPassMatch rule that accepts attacker-supplied FTP URLs, or by being the operator of an FTP server that the proxy is configured to contact). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required against the httpd front-end, but exploitation is fundamentally limited to deployments running 2.4.0-2.4.67 with mod_proxy_ftp actively in use - default Apache installations that do not enable this module are not exposed. The attacker must also be able to serve responses to the httpd process from the FTP backend, so network egress from the proxy to the malicious FTP server is a hard prerequisite.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L yields 7.3 (High) - network reachable, low complexity, no privileges, no user interaction, with low impact across CIA. However, the EPSS score is 0.02% (5th percentile), the issue is not on the CISA KEV list, and no public exploit code has surfaced, indicating this is a low real-world priority despite the High CVSS. The CVSS also implies confidentiality and integrity impacts (C:L/I:L), but the description and tags characterize it as a Denial of Service / infinite loop - there is a mild inconsistency between the vector's CIA breakdown and the DoS-only narrative, which defenders should verify against the upstream Apache advisory. The SSVC framework is not provided in the input data, so automatable/technical-impact classifications cannot be authoritatively stated. Realistic risk is meaningfully constrained by the prerequisite that mod_proxy_ftp must be loaded and configured to proxy to an attacker-influenced FTP backend, which is an uncommon production deployment pattern.

An attacker identifies a public-facing Apache HTTP Server deployment that proxies HTTP requests to FTP backends via mod_proxy_ftp, either coercing a request to a malicious FTP server they control or hosting the FTP endpoint already referenced by the proxy configuration. By returning crafted FTP responses that never satisfy mod_proxy_ftp's parser exit condition, the attacker pins an httpd worker into an infinite loop, and repeats the request to exhaust the MPM worker pool and render the server unresponsive. No public POC is identified at time of analysis, and the CVSS AC:L rating suggests crafting the trigger response is not technically demanding once the prerequisites are met.