CVE-2026-34356

What it actually does

CVE-2026-34356 is a heap-based buffer overflow in Apache HTTP Server 2.4.0 through 2.4.67 when reverse proxy configurations use ProxyPassReverseCookie* handling with responses from a malicious or compromised backend server. A specially crafted backend response can corrupt heap memory in the Apache httpd process. Based on the published CVSS vector, the confirmed impact is availability loss: unauthenticated network-triggered crash or process instability. The advisory does not indicate confirmed confidentiality or integrity impact, and exploit maturity is currently reported as none.

Why it matters to the business

Organizations running affected Apache HTTP Server reverse proxies may experience service outages if a backend server, upstream application, or traffic path is maliciously controlled or compromised. Public-facing web applications, APIs, SSO portals, and internal gateways that depend on Apache httpd for reverse proxying could become unavailable, causing customer-facing downtime, failed transactions, support load, and operational disruption. The vulnerability is not currently in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS activity, and has no known mature exploit, but the affected version range is broad and Apache httpd is widely deployed, so remediation should still be scheduled promptly.

How an attack unfolds

An attacker first needs a way to influence the HTTP response returned by a backend server that sits behind an affected Apache HTTP Server reverse proxy. This may occur if the attacker operates a backend configured behind Apache, compromises an upstream application server, poisons a development or staging backend, or abuses an application flaw that lets them control response headers. The attacker then causes Apache httpd to proxy a request to that backend. The backend returns crafted Set-Cookie or related cookie header data that is processed by ProxyPassReverseCookie* rewriting logic. During processing, Apache httpd writes beyond the bounds of a heap buffer, corrupting process memory. The expected practical result is a worker process crash or repeated instability, producing denial of service for proxied traffic. There is no public indication that reliable remote code execution has been demonstrated for this issue.

How to fix it

Upgrade Apache HTTP Server to version 2.4.68 or later. The advisory identifies 2.4.0 through 2.4.67 as affected and 2.4.68 as the fixed release. Where vendor-packaged Apache builds are used, install the distribution package that backports this fix and verify the vendor advisory maps to this CVE. If immediate upgrade is not possible, reduce exposure by reviewing reverse proxy configurations, removing unnecessary ProxyPassReverseCookieDomain and ProxyPassReverseCookiePath directives, limiting which backend systems can be reached by Apache, ensuring backends are trusted and patched, and adding monitoring/restart controls to reduce outage duration. Mitigations should be treated as temporary because the root issue is fixed by upgrading.

How to confirm the fix worked

Confirm the running Apache httpd version is 2.4.68 or later, or that the operating-system vendor package includes the backported fix. Use commands such as `httpd -v`, `apachectl -v`, `apache2 -v`, or package-manager queries, and verify the actual running service was restarted after update. Review Apache configuration for `ProxyPassReverseCookieDomain` and `ProxyPassReverseCookiePath` directives to identify exposed reverse proxy paths. Confirm all public and internal Apache reverse proxies have been inventoried, including container images and appliance-bundled deployments. After remediation, perform a controlled functional test of reverse-proxied applications and monitor Apache error logs for crash, segmentation fault, child process exit, or abnormal restart messages.

Typical attack path

1. Identify an Apache HTTP Server reverse proxy running version 2.4.0 through 2.4.67 with ProxyPassReverseCookie* directives enabled.
2. Gain control over, compromise, or otherwise influence a backend server or application response handled by the proxy.
3. Return a maliciously crafted cookie-related response header to the Apache reverse proxy.
4. Trigger Apache httpd to process the backend response through ProxyPassReverseCookie* rewriting logic.
5. Cause heap memory corruption in the httpd process.
6. Repeat requests as needed to crash worker processes or degrade availability of proxied services.

How to detect it

To assess possible prior exploitation, focus on evidence of Apache httpd instability correlated with reverse-proxied requests and backend responses containing unusual cookie headers. Review Apache error logs, reverse proxy access logs, backend application logs, system journal logs, core dump records, crash reporters, and process supervisor logs. Look for segmentation faults, heap corruption messages, child process crashes, abnormal exits, graceful restart loops, or spikes in 502/503/504 responses around requests to proxied paths. Compare timestamps between backend responses with large or malformed `Set-Cookie` headers and Apache worker crashes. On Linux systems, check `/var/log/apache2/error.log`, `/var/log/httpd/error_log`, `journalctl -u apache2`, `journalctl -u httpd`, `/var/lib/systemd/coredump/`, and kernel logs for httpd crashes. Because no public exploit pattern or payload is currently established, absence of a known signature does not rule out exploitation; prioritize behavioral evidence and crash correlation.

• ProxyPassReverseCookieDomain
• ProxyPassReverseCookiePath
• AH00051: child pid
• AH00052: child pid
• AH00428: Parent: child process
• segfault at
• httpd segfault
• apache2 segfault
• free(): invalid
• malloc(): corrupted
• corrupted double-linked list
• double free or corruption
• munmap_chunk(): invalid pointer
• /var/log/apache2/error.log
• /var/log/httpd/error_log
• /var/lib/systemd/coredump/
• /usr/sbin/httpd
• /usr/sbin/apache2
• Set-Cookie:

What your security team should do

• Prioritize upgrade of internet-facing or business-critical Apache reverse proxies using affected versions and ProxyPassReverseCookie* directives.
• Upgrade Apache HTTP Server to 2.4.68 or apply the vendor package containing the backported fix, then restart the service.
• Inventory Apache reverse proxy configurations for `ProxyPassReverseCookieDomain` and `ProxyPassReverseCookiePath` to identify where the vulnerable code path is likely reachable.
• Harden trust boundaries between Apache reverse proxies and backend servers; restrict backend access paths and validate that upstream services are not attacker-controlled or compromised.
• Add or tune monitoring for httpd crashes, segmentation faults, repeated worker exits, and unexpected service restarts.
• Review recent Apache and system logs for signs of unexplained instability since publication, especially on hosts proxying traffic to less-trusted backends.
• Track vendor advisories for packaged Apache builds because fixed package versions may differ from upstream 2.4.68.