CVE-2026-34356

Source
https://cve.org/CVERecord?id=CVE-2026-34356
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34356.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34356
Aliases
Downstream
ALPINE (1)
ALSA (3)
AZL (1)
BELL (1)
CLSA (6)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1)
OESA (4)
openSUSE (1)
RHSA (9)
RLSA (3)
ROOT (2)
SUSE (5)
UBUNTU (1)
Related
Published
2026-06-08T15:12:21Z
Modified
2026-11-05T21:32:23Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
Details

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie*

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Database specific
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34356.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "2.4.0"
                        },
                        {
                            "last_affected": "2.4.67"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Database specific
Show details
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.4.0"
                },
                {
                    "fixed": "2.4.68"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34356.json"