AI analysis
Apache HTTP Server has an out-of-bounds write (CWE-787) in mod_proxy_html when it handles crafted HTTP response bodies. An attacker who can supply or influence a proxied response can trigger the flaw, which related reporting describes as a crash in dump_content and which can corrupt memory in the server process. The practical impact is denial of service on affected workers, with possible further memory-corruption consequences; remote code execution is not confirmed in the available data. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that loads mod_proxy_html is affected. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is none known.
What to do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as Apache publishes it. Until then, do not load mod_proxy_html unless HTML rewriting of proxied responses is required, and confirm whether it is loaded with apachectl -M or httpd -M. Treat unexpected worker crashes involving dump_content or mod_proxy_html as possible probing.
Affected
| Apache Software Foundation Apache HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
massmillions of Apache HTTP Server 2.4 installs in the affected version range; only the subset with mod_proxy_html enabled is exposed — Public web-server surveys place Apache HTTP Server on a large share of internet sites, well above 100,000 systems and into the millions of installs; mod_proxy_html is an optional proxy HTML filter and is not enabled on every install.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.