The vulnerability is a classic buffer overflow located in Apache HTTP Server’s mod_proxy_html component. An attacker who can instruct the server to proxy content from an untrusted backend can cause the server to read or write beyond the bounds of a buffer, potentially allowing arbitrary code execution or a crash. The weakness is identified as CWE‑122, a classic stack buffer overflow scenario that can lead to full control over the affected process.

The flaw affects Apache Software Foundation’s Apache HTTP Server, specifically all releases up to and including 2.4.67. The vendor recommends updating to version 2.4.68, which contains a patch that eliminates the overflow by correcting the handling of backend responses.

No CVSS score is publicly disclosed, and EPSS data is unavailable, indicating no current quantifiable estimate of exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves sending crafted requests to the server that trigger the mis‑handled proxying of data, making this a remote exploit that requires only network access and does not rely on local privileges.