Executive brief
The Apache HTTP Server, a widely used web server for hosting websites and applications, contains a vulnerability in its HTML proxy module. An attacker who controls a backend server that the Apache server connects to can send malicious data to trigger a buffer overflow. This could potentially lead to a service crash or allow the attacker to execute unauthorized commands on the web server.
Technical details
A heap-based buffer overflow (CWE-122) exists in the mod_proxy_html module of Apache HTTP Server. The vulnerability is triggered when the server acts as a proxy and receives a specially crafted response from an untrusted or malicious backend server. This flaw allows a remote attacker who controls a backend origin to cause a memory corruption, potentially leading to a denial of service (process crash) or remote code execution. The issue is fixed in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.0 through 2.4.67
Timeline
- 2026-03-21: disclosed: Report received by Apache security team
- 2026-06-04: patched: Fixed in 2.4.x development branch
- 2026-06-08: advisory: Public advisory and version 2.4.68 released