Apache HTTP Server CVE-2026-47360

Exploitation requires Apache httpd to be deployed as a proxy/front end to a backend server with the mod_session_cookie module loaded and the SessionCookieRemove directive configured, AND a configuration in which that directive's effective value changes across an internal redirect (e.g., differing per-directory/location session settings traversed by mod_rewrite or mod_proxy internal redirects). This is a non-default, operator-dependent configuration - servers not using mod_session_cookie, not setting SessionCookieRemove, or not fronting a backend are not affected. The impact is limited to disclosure of the session cookie to the backend server (a trust-boundary leak), not direct confidentiality loss to the external attacker, which materially constrains realistic risk despite the AV:N/PR:N vector.

Signals are mixed and point toward a genuine-but-conditional issue rather than an urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H) scores 7.5 and implies trivially easy remote unauthenticated confidentiality loss, but this conflicts with the description, which requires a specific mod_session_cookie configuration (SessionCookieRemove) that changes across internal redirects in front of a backend server - that is not a default, low-complexity condition, so the vendor's AC:L and C:H appear generous. CISA's SSVC framework corroborates the lower-urgency reading: Exploitation=none (no observed or public exploitation), Automatable=yes, Technical Impact=partial (not total), which argues for a Track/Track* rather than Act decision. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be weighed; this is a data gap, not a low score. The CVE is not in CISA KEV and no POC is indicated, so there is no public exploit identified at time of analysis. Net: a legitimate information-disclosure flaw worth patching in normal cycles, but the headline 7.5/C:H likely overstates real-world risk given the narrow configuration prerequisite and the fact that the cookie leaks to a backend server rather than directly to the attacker.

An operator runs Apache httpd (≤2.4.68) as a reverse proxy using mod_session_cookie with SessionCookieRemove configured, and that directive's value differs across an internal redirect toward a backend. A remote client sends a request that traverses the internal redirect, and the session cookie that should have been stripped is instead forwarded to the backend server, exposing session data to a component that was not supposed to receive it. No public exploit code is identified at time of analysis, and the leak is to the backend rather than directly back to the attacker.