A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. (CVE-2026-34355)
A buffer overflow vulnerability exists in the mod_proxy_html module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows an attack by an untrusted backend to cause a buffer overflow, potentially leading to denial of service. The issue is addressed in Apache HTTP Server version 2.4.68. Red Hat has released security advisories and patches for affected products to remediate this vulnerability.
AI Analysis
Technical Summary
CVE-2026-34355 is a buffer overflow vulnerability in the mod_proxy_html module of Apache HTTP Server 2.4.67 and earlier. An untrusted backend can trigger this overflow, which may result in denial of service conditions. The vulnerability is tracked under CWE-120 and CWE-122 (classic buffer overflow weaknesses). The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. Red Hat has issued multiple advisories providing updated packages (httpd 2.4.68) that fix this vulnerability. Users are advised to upgrade to version 2.4.68 or later to mitigate the issue.
Potential Impact
The vulnerability allows an attacker controlling an untrusted backend to cause a buffer overflow in the mod_proxy_html module, which can lead to denial of service (service crash or unavailability). There is no direct confidentiality or integrity impact reported. The CVSS score of 7.5 reflects a high severity denial of service risk exploitable remotely without authentication.
Mitigation Recommendations
A fix is available in Apache HTTP Server version 2.4.68. Users should upgrade to version 2.4.68 or later to remediate this vulnerability. Red Hat has released updated packages for their supported distributions, and applying these updates will resolve the issue. No additional mitigations are indicated by the vendor advisories.
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. (CVE-2026-34355)
Description
A buffer overflow vulnerability exists in the mod_proxy_html module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows an attack by an untrusted backend to cause a buffer overflow, potentially leading to denial of service. The issue is addressed in Apache HTTP Server version 2.4.68. Red Hat has released security advisories and patches for affected products to remediate this vulnerability.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-34355 is a buffer overflow vulnerability in the mod_proxy_html module of Apache HTTP Server 2.4.67 and earlier. An untrusted backend can trigger this overflow, which may result in denial of service conditions. The vulnerability is tracked under CWE-120 and CWE-122 (classic buffer overflow weaknesses). The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. Red Hat has issued multiple advisories providing updated packages (httpd 2.4.68) that fix this vulnerability. Users are advised to upgrade to version 2.4.68 or later to mitigate the issue.
Potential Impact
The vulnerability allows an attacker controlling an untrusted backend to cause a buffer overflow in the mod_proxy_html module, which can lead to denial of service (service crash or unavailability). There is no direct confidentiality or integrity impact reported. The CVSS score of 7.5 reflects a high severity denial of service risk exploitable remotely without authentication.
Mitigation Recommendations
A fix is available in Apache HTTP Server version 2.4.68. Users should upgrade to version 2.4.68 or later to remediate this vulnerability. Red Hat has released updated packages for their supported distributions, and applying these updates will resolve the issue. No additional mitigations are indicated by the vendor advisories.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3qgf-pp84-379f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-34355"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Patch Information
Threat ID: 6a7b6fd6bf8831d5393eadc5
Added to database: 08/11/2026, 18:54:14 UTC
Last enriched: 08/11/2026, 18:56:55 UTC
Last updated: 08/12/2026, 00:41:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.