This vulnerability (CVE-2026-34355) involves a heap-based buffer overflow in the mod_proxy_html module of Apache HTTP Server. It affects all versions up to and including 2.4.67. An untrusted backend can exploit this flaw to cause a buffer overflow, which may result in a security bypass. The vulnerability has a CVSS 3.1 base score of 7.5 (High severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability but not confidentiality or integrity. The issue is fixed in version 2.4.68. Multiple Red Hat advisories provide patches and updates for affected distributions.

The vulnerability allows an untrusted backend to cause a heap-based buffer overflow in mod_proxy_html, potentially leading to a security bypass. The CVSS score indicates a high severity impact primarily affecting availability. There is no indication of confidentiality or integrity compromise. No known exploits in the wild have been reported at this time.

A fix is available in Apache HTTP Server version 2.4.68. Users should upgrade to this version to remediate the vulnerability. Red Hat has issued multiple security advisories with updated packages that address this issue. Applying these official patches is the recommended mitigation. No additional vendor advisories indicate that no action is required or that the issue is already mitigated without patching.