Not rated
CVE-2026-34355 A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend
Description
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server 2.4 | 2.4.0 → 2.4.67 | No fix stated |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260714175253.489197 | earliest → < 8100020260714175253.489197e6 | 8100020260714175253.489197e6 |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Hardened Images 2.4 | earliest → < 2.4.68-1.hum1 | 2.4.68-1.hum1 |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published |
Show the 5 other branches Hide the 5 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Insights proxy 1.5 1786433656 | earliest → < 1786433656 | 1786433656 |
| JBoss Core Services for RHEL 8 | Versions not published | |
| Red Hat JBoss Core Services 2.4.62.SP5 | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published |
References
- httpd.apache.org httpd.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache HTTP Server
The 139 CVEs of Apache HTTP Server →
CVE-2026-63686
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all…
Not rated
CVE-2026-93546
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write…
Not rated
CVE-2026-79768
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when…
Not rated
CVE-2026-73637
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows…
Not rated