This vulnerability (CVE-2026-34355) is a heap-based buffer overflow in the mod_proxy_html module of Apache HTTP Server 2.4.67 and earlier. An untrusted backend server can exploit this flaw to cause a buffer overflow, which may result in bypassing security controls or executing unauthorized code. The issue is documented by Red Hat and Apache, with a CVSS v3.1 score of 7.5 (high severity), indicating network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. The vulnerability is specifically relevant when Apache HTTP Server is configured to connect to untrusted backend servers. Red Hat advisory recommends disabling mod_proxy_html if not needed or restricting its use to trusted backends with network segmentation and access controls. The fix is available in Apache HTTP Server version 2.4.68 and corresponding updated packages from Red Hat.

The vulnerability allows an attacker controlling an untrusted backend server to trigger a heap-based buffer overflow in Apache HTTP Server's mod_proxy_html module. This can lead to security bypass or arbitrary code execution on the affected system. The CVSS score indicates a high impact on availability (DoS or crash), with no direct impact on confidentiality or integrity. The risk is significant in environments where Apache HTTP Server connects to untrusted backend servers, potentially allowing attackers to compromise the server or disrupt service.

A fix is available in Apache HTTP Server version 2.4.68. Users should upgrade to this version to remediate the vulnerability. If upgrading is not immediately possible, the vendor advisory recommends disabling the mod_proxy_html module if it is not essential. If mod_proxy_html is required, restrict its use to trusted backend servers only by employing network segmentation and access controls. After configuration changes, reload the Apache HTTP Server service to apply the changes. These mitigations reduce the risk until the official fix is applied.