CVE-2026-34355

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/08/6	Mailing List
https://access.redhat.com/errata/RHSA-2026:25042
https://access.redhat.com/errata/RHSA-2026:34109
https://access.redhat.com/errata/RHSA-2026:41906
https://access.redhat.com/errata/RHSA-2026:42828
https://access.redhat.com/errata/RHSA-2026:47046
https://access.redhat.com/errata/RHSA-2026:53371
https://access.redhat.com/errata/RHSA-2026:56868
https://access.redhat.com/errata/RHSA-2026:56869
https://access.redhat.com/errata/RHSA-2026:62165
https://access.redhat.com/errata/RHSA-2026:66323
https://access.redhat.com/errata/RHSA-2026:67152
https://access.redhat.com/security/cve/CVE-2026-34355
https://bugzilla.redhat.com/show_bug.cgi?id=2486414
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34355.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-08 16:16

Updated : 2026-09-14 13:18

NVD link : CVE-2026-34355

Mitre link : CVE-2026-34355

CVE.ORG link : CVE-2026-34355

JSON object : View

Products Affected

apache

http_server

CWE

CWE-122

Heap-based Buffer Overflow

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2026-34355", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34355", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T18:11:57.581951Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache HTTP Server", "versions": [{"status": "affected", "version": "2.4.0", "versionType": "semver", "lessThanOrEqual": "2.4.67"}], "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.4.62-16.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.0.29-13.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.2.50-17.redhat_1.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_jk", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "1:2.4.28-19.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_md", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.3.22-12.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_proxy_cluster", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.9.6-19.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_security", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:2.4.63-13.el10_2.4", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.4.63-1.el10_0.4", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260714175253.489197e6", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.4.62-13.el9_8.5", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.4.57-11.el9_4.5", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.4.62-4.el9_6.6", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services 2.4.62.SP5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "2.4.68-1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "versions": [{"status": "unaffected", "version": "1786433656", "lessThan": "*", "versionType": "rpm"}], "packageName": "insights-proxy/insights-proxy-container-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-08T16:16:38.387", "references": [{"url": "https://httpd.apache.org/security/vulnerabilities_24.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/08/6", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2026:25042", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:34109", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:41906", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:42828", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:47046", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:53371", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56868", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56869", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:62165", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:66323", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:67152", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-34355", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486414", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34355.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.\nUsers are recommended to upgrade to version 2.4.68, which fixes this issue."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en mod_proxy_html en el Servidor HTTP Apache 2.4.67 y anteriores permite un ataque por un backend no confiable. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.4.68, que soluciona este problema."}], "lastModified": "2026-09-14T13:18:18.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03F07E89-F9BF-4913-8250-F79447AA6EBD", "versionEndExcluding": "2.4.68", "versionStartIncluding": "2.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}