CVE-2026-34355

What it actually does

CVE-2026-34355 is a buffer overflow in Apache HTTP Server's mod_proxy_html module in versions 2.4.67 and earlier. The flaw is triggered when Apache, acting as a reverse proxy, processes crafted content returned by a backend server. Because mod_proxy_html rewrites HTML links in proxied responses, a malicious or compromised backend can cause memory corruption during response processing. The published CVSS vector indicates network exploitation with no authentication or user interaction and an availability impact, meaning the most likely practical outcome is crashing Apache worker processes or disrupting the HTTP service rather than data theft or direct content modification.

Why it matters to the business

Organizations using Apache HTTP Server as a reverse proxy with mod_proxy_html enabled may be exposed to service disruption if a backend application, upstream service, or traffic path becomes untrusted or compromised. Successful exploitation can degrade or interrupt web availability, causing outages for public websites, APIs, portals, or internal applications fronted by Apache. The issue is not currently listed in CISA KEV, has no known mature public exploit, and has a low EPSS score with no recent upward trend, but it should still be prioritized where Apache proxies traffic from third-party, partner-managed, internet-facing, or otherwise less trusted backends.

How an attack unfolds

An attacker first needs a way to influence the HTTP response that Apache receives from an upstream backend. This could happen if the attacker controls an upstream service, compromises a backend application, poisons content generated by a backend, or abuses an application feature that reflects attacker-controlled HTML into the proxied response. The attacker then sends or causes a request through Apache to the affected proxied location where mod_proxy_html is enabled. The backend returns specially crafted HTML or response content designed to trigger the buffer overflow while Apache rewrites links in the response. When the vulnerable module parses and transforms that response, memory corruption occurs. In the expected exploitation outcome, one or more Apache worker processes crash; repeated triggering can reduce capacity, exhaust workers, or cause a denial of service for the proxied application.

How to fix it

Upgrade Apache HTTP Server to version 2.4.68 or later. Where operating-system packages are used, apply the vendor-provided Apache/httpd security update that backports the fix, even if the displayed upstream version does not show 2.4.68. If immediate upgrade is not possible, reduce exposure by disabling mod_proxy_html where it is not required, removing or limiting ProxyHTMLURLMap/HTML rewriting configurations, restricting reverse proxying to trusted backends only, and isolating or monitoring backend services that can return attacker-controlled HTML. Ensure process supervision is configured to restart failed workers, but treat this only as resilience, not a fix.

How to confirm the fix worked

Confirm the running Apache build is fixed by checking the package manager security advisory or by verifying Apache HTTP Server is 2.4.68 or later. Confirm whether mod_proxy_html is loaded using commands such as `apachectl -M` or `httpd -M` and review configuration for `proxy_html_module`, `ProxyHTMLURLMap`, `SetOutputFilter proxy-html`, and reverse proxy locations. Validate that all exposed reverse proxy paths using HTML rewriting are either upgraded, disabled, or restricted to trusted upstreams. After remediation, restart or gracefully reload Apache and confirm no vulnerable old worker processes remain. Review error logs after the change to ensure worker crashes or segmentation faults are no longer occurring during proxied response handling.

Typical attack path

1. Identify an Apache HTTP Server reverse proxy using mod_proxy_html on version 2.4.67 or earlier.
2. Gain control over, compromise, or otherwise influence content returned by an upstream backend served through that proxy.
3. Craft a malicious backend HTTP response that is processed by mod_proxy_html during HTML rewriting.
4. Send or trigger a request through Apache to the affected proxied route.
5. Apache receives the crafted backend response and invokes mod_proxy_html processing.
6. The buffer overflow is triggered, causing Apache worker instability or process crashes.
7. Repeat requests to sustain service degradation or denial of service.

How to detect it

Look for evidence of Apache worker crashes correlated with requests to reverse-proxied locations that use mod_proxy_html. Useful log sources include Apache error logs, Apache access logs, reverse proxy logs, backend application logs, systemd journal, syslog, kernel logs, crash reporting directories, and core dump stores. Hunt for segmentation faults, aborted Apache child processes, repeated worker exits, sudden increases in 5xx responses, and service restarts shortly after requests to proxied HTML content. Correlate Apache access log timestamps with backend response logs to identify suspicious responses immediately preceding crashes. If core dumps are available, preserve them and inspect whether the crashing process loaded mod_proxy_html and whether the crash occurred during proxy HTML response rewriting. Because there are no widely documented exploit strings for this issue, detection should focus on behavioral evidence: repeated crashes of `httpd` or `apache2`, especially after traffic to reverse proxy routes backed by untrusted or recently changed upstream services.

• mod_proxy_html
• proxy_html_module
• ProxyHTMLURLMap
• SetOutputFilter proxy-html
• exit signal Segmentation fault (11)
• Segmentation fault
• core dumped
• AH00052: child pid
• AH00484: server reached MaxRequestWorkers
• httpd
• apache2
• /var/log/httpd/error_log
• /var/log/apache2/error.log
• /var/lib/systemd/coredump
• /var/crash
• /var/log/syslog
• /var/log/messages

What your security team should do

• Inventory Apache HTTP Server instances and prioritize those running 2.4.67 or earlier with mod_proxy_html enabled.
• Upgrade affected Apache deployments to 2.4.68 or apply the equivalent vendor security patch.
• Prioritize internet-facing reverse proxies and proxies connected to third-party, partner-managed, or less trusted backends.
• Disable mod_proxy_html and HTML rewriting features where they are not explicitly required.
• Review reverse proxy trust boundaries and ensure only approved backend services can return content through Apache rewriting paths.
• Search recent Apache, system, and crash logs for segmentation faults, worker crashes, and core dumps associated with proxied requests.
• Enable or increase logging around reverse proxy routes temporarily if exploitation is suspected.
• Monitor for repeated requests to the same proxied path followed by Apache worker crashes or availability degradation.