CVE-2026-3234
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection
A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Enterprise Linux 10
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 10
- Platforms
- Unknown
- Default status
affected- Package
- mod_proxy_cluster
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Enterprise Linux 9
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 9
- Platforms
- Unknown
- Default status
affected- Package
- mod_proxy_cluster
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Core Services
- Vendor
- Red Hat
- Product
- Red Hat JBoss Core Services
- Platforms
- Unknown
- Default status
affected- Package
- jbcs-httpd24-mod_proxy_cluster
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Core Services
- Vendor
- Red Hat
- Product
- Red Hat JBoss Core Services
- Platforms
- Unknown
- Default status
affected- Package
- mod_proxy_cluster
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.