Apache HTTP Server CVE-2026-63686

Apache HTTP Server must be configured as a proxy that runs backend responses through mod_xml2enc (in practice via mod_proxy_html content rewriting), and the attacker must control or have compromised the proxied backend server so it can return a response declaring a charset whose conversion partially succeeds and then fails. Exploitation is strongly limited by this trust boundary: the attacker cannot act as an ordinary external client but must sit on the upstream/backend side, so deployments that proxy only trusted internal backends, or that do not enable mod_xml2enc/mod_proxy_html, are not exposed. Impact is confined to denial of service (worker/child process crash); there is no confidentiality or integrity effect.

No CVSS vector, EPSS score, KEV listing, or POC was provided in the input, so several standard prioritization signals are missing and are stated here explicitly rather than inferred. Based on the description alone, this is a NULL pointer dereference (CWE-476) producing only a denial-of-service outcome with no confidentiality or integrity impact. The decisive limiting factor is the threat model: exploitation requires an 'untrusted backend server' to return a crafted proxied response, meaning Apache must be deployed as a reverse/forward proxy with mod_xml2enc processing backend content (typically via mod_proxy_html) AND be proxying to a backend the attacker controls or has compromised. This is a non-default, comparatively uncommon configuration, and proxying to untrusted backends is already discouraged. There is no CISA KEV entry and no public exploit identified at time of analysis. Net assessment: despite the ubiquity of Apache HTTP Server itself, the real-world risk of this specific issue is low-to-moderate and situational - it is a DoS-only bug gated behind an unusual trust boundary, not a high-urgency widespread-exploitation threat. Patch during normal maintenance unless you knowingly proxy untrusted backends through mod_xml2enc.

An organization runs Apache HTTP Server (before 2.4.69) as a reverse proxy using mod_proxy_html/mod_xml2enc to rewrite content from a backend application. An attacker who controls or compromises that backend returns a response declaring a charset whose character-set conversion partially succeeds and then fails, triggering a NULL pointer dereference that crashes the handling worker and denies service. No public exploit code is identified at time of analysis, and success depends on the proxy being configured to run untrusted backend content through mod_xml2enc.