https://seclists.org/oss-sec/2026/q4/17: CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_proxy_html processes crafted HTTP response bodies. Version 2.4.69 contains the fix.

Q: What does an attacker need to exploit it?

An attacker needs to cause mod_proxy_html to process a crafted HTTP response body. The available information does not state any additional authentication or access requirements.

Q: What should teams do if they cannot immediately upgrade?

The provided information identifies mod_proxy_html as the affected component. If upgrading to 2.4.69 is not immediately possible, assess whether mod_proxy_html is enabled and processes responses that an attacker could influence.

Q: How can I determine whether a server is affected?

Check the Apache HTTP Server version and whether mod_proxy_html is in use. Servers running versions 2.4.0 through 2.4.68 are within the affected range; the fix was released in 2.4.69.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_proxy_html processes crafted HTTP response bodies. Version 2.4.69 contains the fix.

What does an attacker need to exploit it?

An attacker needs to cause mod_proxy_html to process a crafted HTTP response body. The available information does not state any additional authentication or access requirements.

What should teams do if they cannot immediately upgrade?

The provided information identifies mod_proxy_html as the affected component. If upgrading to 2.4.69 is not immediately possible, assess whether mod_proxy_html is enabled and processes responses that an attacker could influence.

How can I determine whether a server is affected?

Check the Apache HTTP Server version and whether mod_proxy_html is in use. Servers running versions 2.4.0 through 2.4.68 are within the affected range; the fix was released in 2.4.69.