CVE-2026-56449

A flaw was found in the mod_proxy_html module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service (DoS).

This issue was introduced upstream in Apache httpd version 2.4.68 as part of the fix for CVE-2026-34355.

The issue was introduced to some Red Hat Enterprise Linux httpd packages via backport of the original fix for CVE-2026-34355:

Red Hat Enterprise Linux 10 - RHSA-2026:34109 https://access.redhat.com/errata/RHSA-2026:34109

Red Hat Enterprise Linux 10.0 Extended Update Support - RHSA-2026:47046 https://access.redhat.com/errata/RHSA-2026:47046

The following Red Hat Enterprise Linux errata included corrected patch for CVE-2026-34355 and did not introduce this regression. Relevant Red Hat Enterprise Linux versions were therefore never affected by this CVE:

Red Hat Enterprise Linux 9 - RHSA-2026:41906
https://access.redhat.com/errata/RHSA-2026:41906

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions - RHSA-2026:67152
https://access.redhat.com/errata/RHSA-2026:67152

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions - RHSA-2026:66323
https://access.redhat.com/errata/RHSA-2026:66323

Red Hat Enterprise Linux 9.6 Extended Update Support - RHSA-2026:62165
https://access.redhat.com/errata/RHSA-2026:62165

Red Hat Enterprise Linux 8 - RHSA-2026:42828
https://access.redhat.com/errata/RHSA-2026:42828

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the mod_proxy_html module if HTML link rewriting is not required:

1. Comment out the module loader directive in /etc/httpd/conf.modules.d/00-proxyhtml.conf:

# sed -i 's/^\s*LoadModule proxy_html_module/#&/' /etc/httpd/conf.modules.d/00-proxyhtml.conf

Alternatively, set ProxyHTMLEnable Off in the affected server or virtual host configuration.

2. Reload the Apache HTTP Server:

# systemctl reload httpd

Caveats: Disabling mod_proxy_html or turning off ProxyHTMLEnable halts automated rewriting of URLs in proxied HTML responses, which may break web applications that depend on backend path translation.

Warning: Reloading or restarting the httpd service may temporarily interrupt active network connections.