CVE-2026-44631: Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

Synopsis

Heap underflow (buffer underwrite) in Apache HTTP Server versions 2.4.0 through 2.4.67, triggered by crafted regular expressions processed through the ap_regname function. The vulnerability is reachable over the network without any authentication or user interaction required. Successful exploitation gives an attacker full read, write, and crash capability against the affected server process, enabling remote code execution, data theft, and service disruption. No upstream fix has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Apache ships a confirmed fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network, meaning an attacker can reach it from any internet-connected host without needing prior access to the system.

• AuthenticationNot required

  No account, session token, or credential of any kind is required to trigger the vulnerability.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can exploit the flaw entirely without involving any human target.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors outside the attacker's control.

Blast Radius

• An attacker can read arbitrary heap memory from the Apache HTTP Server process, exposing in-flight request data, session tokens, and any secrets resident in the process address space.
• An attacker can write to arbitrary heap memory below the intended buffer boundary, enabling remote code execution within the privileges of the web server process.
• The heap corruption can be used to crash the Apache HTTP Server worker process, causing a denial of service for all requests handled by that worker.
• If the server process runs with elevated privileges or shares memory with other services, the impact extends beyond the HTTP layer to other components in the same container or host environment.