CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content
Apache httpd mod_proxy_html can crash in dump_content; CVE-2026-56449 is rated low.
Eric Covener disclosed CVE-2026-56449, a crash in Apache HTTP Server module mod_proxy_html inside dump_content. Apache rates the issue low severity. The oss-security note links to the httpd 2.4 vulnerabilities page and does not report exploitation.
- Crash in mod_proxy_html function dump_content.
- Tracked as CVE-2026-56449 and rated low.
- Disclosed on oss-security by Eric Covener.
- No in-the-wild exploitation is stated.
Vulnerabilities mentionedAll →
- CVE-2026-564497.5—Out-of-bounds write in Apache HTTP Server mod_proxy_htmlpublished · Apache Software Foundation Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-56449 | Out-of-bounds write in Apache HTTP Server mod_proxy_html Apache HTTP Server has an out-of-bounds write (CWE-787) in mod_proxy_html when it handles crafted HTTP response bodies. An attacker who can supply or influence a proxied response can trigger the flaw, which related reporting describes as a crash in dump_content and which can corrupt memory in the server process. The practical impact is denial of service on affected workers, with possible further memory-corruption consequences; remote code execution is not confirmed in the available data. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that loads mod_proxy_html is affected. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is none known. Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as Apache publishes it. Until then, do not load mod_proxy_html unless HTML rewriting of proxied responses is required, and confirm whether it is loaded with apachectl -M or httpd -M. Treat unexpected worker crashes involving dump_content or mod_proxy_html as possible probing. |
Posted by Eric Covener on Oct 01 Severity: low https://httpd.apache.org/security/vulnerabilities_24.html https://httpd.apache.org/...
This source does not provide full text. Read it at seclists.org.