EUVD-2026-90895
GHSA-76ff-8r4r-vpm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Apache proxy using mod_proxy_html
-
DeliveryInduce proxying of attacker-controlled response body
-
ExploitTrigger out-of-bounds write in HTML link rewriter
-
ExecutionCorrupt memory / crash worker process
-
ImpactDenial of service or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that Apache HTTP Server be deployed with the mod_proxy_html module loaded and actively rewriting proxied HTML content - this is NOT a default configuration; stock Apache installs without proxy/HTML-rewriting are not affected. Exploitation further requires the attacker to influence the HTTP response body that mod_proxy_html parses, i.e., control over (or interception of) an upstream/backend response the server proxies and rewrites. LIMITING FACTORS: the module must be explicitly enabled and configured for HTML output filtering; servers used purely as origin web servers, or proxies not using mod_proxy_html, are out of scope. Affected versions are 2.4.0 through 2.4.68; upgrading to the fixed 2.4.x release remediates. |
| Impact | Critical signals are MISSING: the input provides no CVSS score/vector, no EPSS probability, no KEV listing, no SSVC decision data, and no POC reference - only a vendor advisory (httpd.apache.org security vulnerabilities page), CWE-787 (Out-of-bounds Write), and the affected range 2.4.0-2.4.68. Because no CVSS vector is supplied, authentication requirements cannot be confirmed from the data. Exploitation status: no public exploit identified at time of analysis. The realistic risk is moderate and conditional rather than broadly critical: mod_proxy_html is a non-default, separately-configured module used to rewrite links in proxied HTML, so exposure depends entirely on whether a given Apache deployment loads and uses it as a (reverse/forward) proxy. An out-of-bounds write triggered by a crafted response body most plausibly yields worker-process crashes (DoS) with a theoretical but unconfirmed path to memory corruption/code execution - the advisory text here does not specify impact, so any RCE claim would be speculation. Net: this is a real issue for the subset of Apache servers running mod_proxy_html as a content-rewriting proxy, but absent EPSS/KEV/POC it is not evidenced as widespread active exploitation; treat as patch-soon, not emergency, and confirm module usage before prioritizing. |
| Exploit ScenarioDerived | An attacker causes an Apache server running mod_proxy_html to fetch and rewrite a malicious HTTP response body (e.g., from an attacker-controlled or compromised upstream/backend that the proxy processes), triggering the out-of-bounds write during HTML link rewriting. This most likely crashes the worker (denial of service) and could potentially corrupt memory. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.
RemediationAI
Patch available per vendor advisory: affected deployments should be upgraded off the 2.4.0 through 2.4.68 range to the fixed 2.4.x release identified in the Apache HTTP Server security vulnerabilities page at https://httpd.apache.org/security/vulnerabilities_24.html - the provided data does not specify the exact fixed version string, so confirm the precise version at that advisory before planning the upgrade. Where an immediate upgrade is not possible, the most direct compensating control is to stop exercising the vulnerable code path by removing or disabling the mod_proxy_html filter (for example, by not loading the module, or by setting ProxyHTMLEnable/related directives to Off for any virtual host that does not require HTML rewriting); the trade-off is that proxied HTML will no longer have its links and URLs rewritten, which can break backend content presentation behind the proxy. A narrower mitigation is to restrict whether untrusted parties can influence the upstream response body that mod_proxy_html parses - proxy only trusted backends, terminate and validate upstream responses on a hardened hop, and avoid proxying to origins that reflect attacker-supplied HTML - though this reduces exposure rather than eliminating the flaw and requires trust assumptions about the proxied content path. Because exploitation requires a non-default configuration and attacker control of the proxied response, inventorying which hosts actually load and enable mod_proxy_html is the fastest way to prioritize patching; note that no public exploit has been identified at the time of analysis, so urgency should be driven by internet exposure of the rewriting proxy rather than by observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mod_proxy_html is an output filter shipped with Apache HTTP Server that rewrites URLs and links inside HTML documents returned by a proxied backend, so a reverse proxy can present backend content under a different external address space. Because the filter parses attacker-influenceable HTML, it handles length and offset arithmetic on data derived directly from the response body. CWE-787 (Out-of-Bounds Write) describes the root-cause class here: the module fails to properly validate a size or boundary before writing to a buffer, so a crafted HTTP response body can cause writes beyond the allocated region, producing memory corruption that in the assessed impact yields low confidentiality and integrity compromise and a high availability impact (typically a crash or denial of service, with theoretical potential for further exploitation depending on memory layout and platform hardening). The supplied CPE string (cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:*) is an unversioned wildcard for the Apache HTTP Server product, so the authoritative scope comes from the vendor advisory, which constrains the affected range to 2.4.0 through 2.4.68. Per the independent assessment, the vulnerability is only reachable when the module is loaded and configured to filter HTML output and when the attacker can control or intercept an upstream response that the server proxies - conditions that raise attack complexity and exclude stock origin-only installations.
Know when Apache Http Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable via proxied content but requires attacker-influenced response body and the non-default mod_proxy_html config (AC:H); no auth to the proxy (PR:N); impact is primarily worker crash (A:H) with possible memory corruption (C:L/I:L).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
DescriptionCVE.org
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Apache Http Server
View allRemote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client
Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
Exploit-DB