CVE-2026-3234: Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection
A flaw was found in modproxycluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.
Other sources
CRLF injection in modproxycluster's decodeenc() function allows attackers to bypass input validation and inject CRLF sequences into cluster configuration, resulting in response body corruption in INFO endpoint responses.
Exploit requires network access to the MCMP protocol port (typically port 6666, usually restricted to internal/management networks). No authentication required due to validation bypass. Attacker must be able to send MCMP CONFIG messages.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3234?
CVE-2026-3234 is considered a medium severity vulnerability due to its potential for response body corruption.
How do I fix CVE-2026-3234?
To fix CVE-2026-3234, update to the latest version of mod_proxy_cluster that addresses the CRLF injection issue.
What are the potential impacts of CVE-2026-3234?
The potential impacts of CVE-2026-3234 include unauthorized manipulation of response data leading to information disclosure.
Who is affected by CVE-2026-3234?
CVE-2026-3234 affects users of mod_proxy_cluster that implement the decodeenc() function without adequate input validation.
Is CVE-2026-3234 being actively exploited?
As of now, there is no public evidence indicating that CVE-2026-3234 is being actively exploited in the wild.