{"id":"CVE-2026-56449","published":"2026-10-01T17:17:26.733","lastModified":"2026-10-05T13:29:51.137","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-787"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/18","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache HTTP Server's mod_proxy_html module contains an out-of-bounds write vulnerability that can be triggered by processing crafted HTTP response bodies. This flaw allows attackers to write data beyond the allocated buffer boundaries, potentially leading to memory corruption and arbitrary code execution in the context of the web server process.","exploitability":"Exploitation requires a malicious HTTP response body that triggers the out-of-bounds write in mod_proxy_html, with no additional preconditions needed for successful exploitation.","blast_radius":"If exploited, this vulnerability could impact all Apache HTTP Server installations using mod_proxy_html with versions between 2.4.0 and 2.4.68, potentially allowing remote code execution with the privileges of the web server process.","remediation":"Upgrade to Apache HTTP Server 2.4.69 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","memory-corruption","proxy"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:37.433Z"}}