The vulnerability is a buffer underflow caused by a signed character overflow in the `ap_regname` function, which processes regular expression patterns in Apache HTTP Server configuration files. This flaw falls under CWE-124 and can lead to memory corruption that may allow an attacker to execute arbitrary code or crash the server. Because the affected area lies in the parsing of configuration directives, exploitation would require malformed configuration input to trigger the overflow.

Apache HTTP Server version 2.4.0 through 2.4.67 are vulnerable. Versions 2.4.68 and later include the fix. The issue is specific to the HTTP server component of the Apache Software Foundation's product line.

The CVSS score is 9.8, and EPSS is not available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is configuration‑based, meaning that an attacker would need the ability to inject crafted regular expressions into the server's configuration file. This typically requires local or privileged access or a web interface that allows configuration changes. Given the absence of a publicly available exploit and the need for configuration modification, the risk is considered moderate, but the potential for remote code execution warrants prompt remediation.