A heap-based buffer overflow vulnerability exists in the mod_proxy_html module of Apache HTTP Server 2.4.67 and earlier. This vulnerability can be triggered by an untrusted backend server, leading to a buffer overflow condition that may allow an attacker to bypass security controls. The issue is fixed in version 2.4.68. Red Hat's advisory confirms the vulnerability and provides updated httpd packages to remediate the issue. The CVSS score of 7.5 reflects a network attack vector with low complexity and no required privileges or user interaction, impacting availability but not confidentiality or integrity.

The vulnerability can be exploited remotely by an attacker controlling an untrusted backend server to cause a heap-based buffer overflow in the mod_proxy_html module. This may result in denial of service or other availability impacts. There is no indication of confidentiality or integrity compromise from this vulnerability based on the provided data. No known exploits in the wild have been reported.

A fix is available in Apache HTTP Server version 2.4.68. Users are strongly recommended to upgrade to this version to remediate the vulnerability. Red Hat has released updated httpd packages for Red Hat Enterprise Linux 10.0 Extended Update Support that include this fix. Applying these vendor-provided updates is the primary mitigation. Patch status is confirmed by the vendor advisory.