CVE-2026-34355— Apache HTTP Server: mod_proxy_html buffer overflow
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.0≤ 2.4.67 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34355
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache HTTP Server: mod_proxy_html buffer overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
Apache HTTP Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.67及之前版本存在安全漏洞，该漏洞源于mod_proxy_html存在缓冲区溢出，可能导致不可信后端攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.0 ~ 2.4.67 | - |
II. Public POCs for CVE-2026-34355
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34355
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-34355 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-08 · 14 CVEs total
| CVE-2026-47430 | Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without | |
| CVE-2026-29167 | Apache HTTP Server: mod_ldap per-dir use-after-free | |
| CVE-2026-29170 | Apache HTTP Server: mod_proxy_ftp XSS | |
| CVE-2026-44186 | Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp | |
| CVE-2026-34356 | Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow | |
| CVE-2026-42535 | Apache HTTP Server: mod_dav_fs protected directory access | |
| CVE-2026-43951 | Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash | |
| CVE-2026-44119 | Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple m | |
| CVE-2026-44631 | Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow | |
| CVE-2026-44185 | Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` | |
| CVE-2026-42536 | Apache HTTP Server: mod_xml2enc heap overflow | |
| CVE-2026-48913 | Apache HTTP Server: mod_http2 memory corruption when file handles exhausted | |
| CVE-2026-49975 | Apache HTTP Server: mod_http2 denial of service |
IV. Related Vulnerabilities
Same product: Apache HTTP Server
- CVE-2026-49975
Apache HTTP Server: mod_http2 denial of service - CVE-2026-48913
Apache HTTP Server: mod_http2 memory corruption when file ha - CVE-2026-42536
Apache HTTP Server: mod_xml2enc heap overflow - CVE-2026-44185
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP ` - CVE-2026-44631
Apache HTTP Server: Heap Underflow in `ap_regname` via Signe
Same vendor: Apache Software Foundation
- CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v - CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
Same weakness: CWE-122
- CVE-2026-19970
Open Asset Import Library Assimp Node MDLLoader.cpp AddBones - CVE-2026-19968
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h - CVE-2026-19967
Open Asset Import Library Assimp File Compression.cpp decomp - CVE-2026-72970
Microsoft Edge (Chromium-based) Remote Code Execution Vulner - CVE-2026-19385
PostgreSQL pg_dump heap buffer overflow executes arbitrary c
V. Comments for CVE-2026-34355
No comments yet