PT-2026-47317 · Apache+2 · Apache Http Server+2

Arkadi Vainbrand + 1 · CVE-2026-34356 · Published 2026-06-08 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.67

Description A heap-based buffer overflow occurs when interacting with malicious backend servers using ProxyPassReverseCookie*. A heap-based buffer overflow is a memory corruption issue where data exceeds the allocated boundary of a buffer on the heap, potentially leading to crashes or arbitrary code execution.

Recommendations Upgrade to version 2.4.68.

Fix

DoS

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

ALSA-2026:34109

ALSA-2026:41906

ALSA-2026:42828

BIT-APACHE-2026-34356

CVE-2026-34356

ECHO-4833-98FE-E642

OPENSUSE-SU-2026:21235-1

RHSA-2026:25042

RHSA-2026:34109

SUSE-SU-2026:22564-1

SUSE-SU-2026:2686-1

SUSE-SU-2026:2717-1

SUSE-SU-2026:2735-1

SUSE-SU-2026:2759-1

USN-8516-1

USN-8571-1

Affected Products

Apache Http Server

Linuxmint

Rocky Linux

References · 181

• https://errata.rockylinux.org/RLSA-2026:42828 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43951 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-41906.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29167 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-49975 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-41906.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2759-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42536 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34032 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-34109.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-8571-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2717-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-34356 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8516-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48913 · Vendor Advisory