Description
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.



This issue affects Apache HTTP Server version 2.4.68.
Published: 2026-10-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds write in the mod_proxy_html module’s dump_content function, allowing an attacker to send maliciously crafted HTTP response bodies to an Apache HTTP Server instance. The out‑of‑bounds write corrupts internal data structures and causes the server to crash, resulting in a denial of service that can be triggered remotely without authentication.

Affected Systems

Apache HTTP Server versions 2.4.0 through 2.4.68, when the mod_proxy_html module is enabled, are affected.

Risk and Exploitability

Exploitability analysis reveals an out‑of‑bounds write that can be triggered remotely via crafted HTTP response bodies processed by the mod_proxy_html module. The CVSS score of 7.5 indicates a high severity level. No authentication is required, and no local privileges are necessary. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, but the remote nature and potential for widespread service interruption make remediation a priority.

Generated by OpenCVE AI on October 1, 2026 at 20:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.69 or later, where the out‑of‑bounds write in mod_proxy_html is fixed.
  • If an immediate upgrade is not possible, temporarily disable the mod_proxy_html module to block the vulnerable functionality.
  • While the module is disabled or before the upgrade, apply firewall or access‑control rules to restrict traffic that would invoke mod_proxy_html and limit exposure to untrusted sources.

Generated by OpenCVE AI on October 1, 2026 at 20:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6569-1 apache2 security update
History

Wed, 21 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Description Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.

Mon, 05 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server

Thu, 01 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Title Apache HTTP Server: mod_proxy_html: crash in dump_content
Weaknesses CWE-787
References

Subscriptions

Apache Http Server
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T07:59:33.661Z

Reserved: 2026-06-22T12:59:42.862Z

Link: CVE-2026-56449

cve-icon Vulnrichment

Updated: 2026-10-01T20:09:24.694Z

cve-icon NVD

Status : Modified

Published: 2026-10-01T17:17:26.733

Modified: 2026-10-21T08:16:44.203

Link: CVE-2026-56449

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-01T16:06:24Z

Links: CVE-2026-56449 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T21:00:17Z

Weaknesses