CVE-2026-3234 identifies a flaw in Apache mod_proxy_cluster where a carriage return line feed (CRLF) injection in the decodeenc() function allows a remote attacker to bypass input validation. The attacker can inject CRLF sequences into the cluster configuration, corrupting the response body of INFO endpoint responses. This does not provide execution privileges but can expose manipulated data or create confusion in downstream components. The CVSS score of 4.3 indicates moderate severity, reflecting limited impact confined to the INFO endpoint and no authenticated privileges.

The vulnerability affects Red Hat Enterprise Linux 9 and 10 as well as Red Hat JBoss Core Services, all of which ship with mod_proxy_cluster. Any system running these products and exposing the MCMP protocol (typically port 6666) is at risk. Specific product versions are not enumerated in the CNA data; however, all current releases of the affected products include the vulnerable module unless patched by Red Hat.

Exploitation requires network access to the MCMP protocol port and does not require authentication, but the EPSS score of less than 1% indicates a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting it is not widely exploited in the wild. The primary attack vector is remote network traffic targeting the open MCMP port, which can be mitigated by restricting inbound connections to trusted internal or management networks. Without such controls, an attacker could inject CRLF sequences and corrupt INFO responses, potentially revealing manipulated configuration data or causing unintended behavior in cluster communication.