The vulnerability is a stack‑based buffer overflow in Apache HTTP Server’s mod_proxy_html component. It occurs when the module improperly processes responses from a backend server. Based on the description, it is inferred that an attacker can trigger the overflow by directing the server to proxy content from an untrusted backend. The resulting memory corruption may cause the server to crash or, in the worst case, allow arbitrary code execution if the attacker can control the overflowed data. The weakness is identified as CWE‑120 and CWE‑122.

The flaw affects Apache HTTP Server, versions 2.4.67 and earlier, which include the mod_proxy_html module. The vendor recommends upgrading to version 2.4.68 or later to apply the patch that fixes the buffer handling in the proxy module.

The CVSS score of 7.5 denotes high severity, and the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network, requiring an attacker to send crafted requests that trigger the faulty proxy handling. The exploit does not require local privileges and can be executed from an external host that can communicate with the web server.