VulnSocial

CVE-2026-34355Patch(apache / http_server)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache http_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-122CWE-120

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • http_server

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-06-09); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
apache
Products
http_server

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-09: 1Mentions · 2026-06-16: 1Mentions · 2026-07-13: 1Patch / Workaround · 2026-06-09: 1Patch / Workaround · 2026-06-16: 1Patch / Workaround · 2026-07-13: 1Technical Details · 2026-06-09: 1Technical Details · 2026-06-16: 1Technical Details · 2026-07-13: 106-0906-1607-13
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-091
Disclosure1
2026-06-161
Patch1
2026-07-131
Patch1
Full discourse3 posts
  • Kazuki Omo@omokazuki
    Disclosure

    SIOSセキュリティブログを更新しました。 Apacheの脆弱性(Moderate: CVE-2026-34355, CVE-2026-42535, CVE-2026-43951, CVE-2026-44119, CVE-2026-44186, CVE-2026-49975, Low:複数)と2.4.68リリース #sios_tech #security #vulnerability #セキュリティ #脆弱性 #apache https://security.sios.jp/vulnerability/apache-security-vulnerability-20260609/

    Post summary

    The blog update lists several Apache CVEs with moderate and low severity and mentions the upcoming 2.4.68 release, indicating that patches are available.

    00021186
    372 followersView on X
  • iototsecnews@iototsecnews
    Patch

    Apache HTTP Server の複数の脆弱性が FIX：コード実行や権限昇格の恐れ https://iototsecnews.jp/2026/06/09/apache-http-server-2-4-68-patches-multiple-security-vulnerabilities/ Apache HTTP Server における複数の脆弱性の原因は、各モジュールにおけるメモリ処理や入力検証の不備にあります。たとえば、CVE-2026-34355／CVE-2026-34356 では信頼できない応答を処理する際のバッファオーバーフロー、CVE-2026-49975 では HTTP/2 リクエスト時の過剰なメモリ割り当ての制御不備、CVE-2026-44119 では式処理の不備が原因となっています。これらのプログラム内の確認や制限の不具合により、サーバの不安定化や制限されたリソースへのアクセスといった危険性が生じています。ご利用のチームは、ご注意ください。 #Apache #CVE202629167 #CVE202629170 #CVE202634355 #CVE202634356 #CVE202642536 #CVE202648913 #CVE202649975 #HTTPServer #Vulnerability

    Post summary

    The article reports multiple new CVEs in Apache HTTP Server, describing technical details and indicating that patches are available to mitigate the vulnerabilities.

    01100641
    499 followersView on X
  • TECHEPAGES@techepages
    Patch

    8 Apache HTTP Server CVEs patched in Debian 13.6 🚨 🔵 CVE-2026-29167 – mod_ldap UAF (CVSS ~9.8) 🔵 CVE-2026-48913 – mod_http2 UAF (7.3) 🔵 CVE-2026-34355/34356/42536 – buffer overflows 🔵 CVE-2026-29170 – mod_proxy_ftp XSS 🔵 CVE-2026-49975/44186 – DoS Upgrade to httpd 2.4.68 ⬆️

    Post summary

    The post announces Debian 13.6 includes patches for eight Apache HTTP Server CVEs and advises users to upgrade to httpd 2.4.68 to remediate them.

    0001050
    19 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachehttp_server---

Explore more

Back to dashboardapache CVEshttp_server vulnerabilities