CVE-2026-34355: Apache HTTP Server: mod_proxy_html buffer overflow

Synopsis

A buffer overflow in mod_proxy_html, part of Apache HTTP Server 2.4.67 and earlier, is reachable over the network without any authentication. An untrusted backend can trigger the overflow by sending crafted HTML content through the proxy module. Successful exploitation causes a denial of service by crashing the affected server process. HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an official fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable module is exposed over the network; an attacker must be able to send requests to the Apache HTTP Server instance or control a backend that returns responses to it.

• AuthenticationNot required

  No credentials or account of any kind are needed to trigger the overflow, either from an external client or from an untrusted backend.

• Victim interactionNot required

  Exploitation is fully server-side; no user needs to click a link or take any action for the attack to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental variables.

Blast Radius

• The affected Apache HTTP Server worker process crashes, taking down request handling for all connections it was serving at the time.
• Repeated exploitation can keep the server unavailable, causing a sustained denial of service for all traffic routed through the proxy.
• No confidential data is read and no stored data is modified; the impact is limited entirely to availability.