The vulnerability is a NULL pointer dereference in mod_xml2enc triggered by a charset conversion failure in a proxied response. When an untrusted backend sends a response whose charset conversion partially succeeds and then fails, the server dereferences a null pointer, causing a crash. The crash results in a denial of service, denying all clients from using the affected Apache HTTP Server. This weakness is classified as CWE-476 and affects all platforms running a version before 2.4.69.

Apache HTTP Server versions before 2.4.69 from the Apache Software Foundation on all supported platforms. The module mod_xml2enc is present in every release of the 2.4 series; no additional product information beyond the server itself is required.

The CVSS score is 7.5, and EPSS is not available, so the exploitation probability cannot be quantified. However, the vulnerability can be triggered by an attacker who controls an untrusted backend server that the Apache instance proxies. If such an attacker can send crafted responses, the risk is that the server will crash, causing a widespread denial of service. The issue is not listed in the CISA KEV catalog; nevertheless, because it leads to a server crash, it should be treated with a high priority for remediation. There are no known mitigations beyond applying the vendor patch.