CVE-2026-34355
Apache HTTP Server: mod_proxy_html buffer overflow
CVSS Score
7.5
EPSS Score
0.9%
EPSS Percentile
57th
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
| CWE | CWE-122 |
| Vendor | apache software foundation |
| Product | apache http server |
| Published | Jun 8, 2026 |
| Last Updated | Jul 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache http server
Be the first to know when new high vulnerabilities affecting apache software foundation apache http server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache HTTP Server
2.4.0 ≤ 2.4.67
References
httpd.apache.org: https://httpd.apache.org/security/vulnerabilities_24.html openwall.com: http://www.openwall.com/lists/oss-security/2026/06/08/6 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-34355 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2486414 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34355.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34109 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42828 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41906 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25042
Credits
Elhanan Haenel Junhui Lee