The vulnerability is an infinite loop triggered in mod_proxy_ftp's proxy_ftp_handler when the backend FTP server is under attacker control. Because the loop has an unreachable exit condition, each proxy request can consume excessive resources, eventually exhausting CPU and memory and causing the Apache HTTP Server to become unresponsive. The impact is a denial of service that can affect availability for users and applications relying on the server.

Apache HTTP Server releases from 2.4.0 through 2.4.67 are affected. The issue was fixed in the 2.4.68 release.

The current EPSS metric is unavailable, but exploitation is achievable remotely by configuring the server to proxy connections to an attacker-controlled FTP server and then sending requests. The loop can be sustained indefinitely, producing a sustained denial of service. The absence of a CISA KEV listing indicates no publicly known exploit activity yet, yet the severity and ease of configuration changes render the risk high. Users should apply the 2.4.68 patch or mitigate through configuration changes.