CVE-2026-3234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3234", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-02-26T00:17:46.458Z", "datePublished": "2026-03-12T10:54:25.456Z", "dateUpdated": "2026-11-06T18:24:20.622Z"}, "containers": {"cna": {"title": "Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection", "metrics": [{"other": {"content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "mod_proxy_cluster", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "mod_proxy_cluster", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "jbcs-httpd24-mod_proxy_cluster", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_core_services:1"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "mod_proxy_cluster", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_core_services:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-3234", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442889", "name": "RHBZ#2442889", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-02-26T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-93: Improper Neutralization of CRLF Sequences", "workarounds": [{"lang": "en", "value": "Restrict network access to the MCMP protocol port (typically 6666) for systems running Apache mod_proxy_cluster. Configure firewall rules to limit inbound connections to this port only from trusted internal or management networks. This action reduces the attack surface by preventing unauthorized remote access to the vulnerable service. A service reload or restart may be required for firewall changes to take full effect."}], "timeline": [{"lang": "en", "time": "2026-02-26T00:15:55.666Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-26T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Coty Sutherland (@csutherl) (IBM) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T18:24:20.622Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T13:15:10.416041Z", "id": "CVE-2026-3234", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:15:53.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T13:15:10.416041Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:15:49.984Z"}}], "cna": {"title": "Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection", "credits": [{"lang": "en", "value": "Red Hat would like to thank Coty Sutherland (@csutherl) (IBM) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "mod_proxy_cluster", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "mod_proxy_cluster", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-mod_proxy_cluster", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "mod_proxy_cluster", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-02-26T00:15:55.666Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-26T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-02-26T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-3234", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442889", "name": "RHBZ#2442889", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Restrict network access to the MCMP protocol port (typically 6666) for systems running Apache mod_proxy_cluster. Configure firewall rules to limit inbound connections to this port only from trusted internal or management networks. This action reduces the attack surface by preventing unauthorized remote access to the vulnerable service. A service reload or restart may be required for firewall changes to take full effect."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "Improper Neutralization of CRLF Sequences"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T18:24:20.622Z"}, "x_redhatCweChain": "CWE-93: Improper Neutralization of CRLF Sequences"}}, "cveMetadata": {"cveId": "CVE-2026-3234", "state": "PUBLISHED", "dateUpdated": "2026-11-06T18:24:20.622Z", "dateReserved": "2026-02-26T00:17:46.458Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-03-12T10:54:25.456Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "mod_proxy_cluster", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "mod_proxy_cluster", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-mod_proxy_cluster", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "affected", "packageName": "mod_proxy_cluster", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en mod_proxy_cluster. Esta vulnerabilidad, una inyecci\u00f3n de Retorno de Carro y Salto de L\u00ednea (CRLF) en la funci\u00f3n decodeenc(), permite a un atacante remoto eludir la validaci\u00f3n de entrada. Al inyectar secuencias CRLF en la configuraci\u00f3n del cl\u00faster, un atacante puede corromper el cuerpo de la respuesta de las respuestas del endpoint INFO. La explotaci\u00f3n requiere acceso de red al puerto del protocolo MCMP, pero no se necesita autenticaci\u00f3n."}], "id": "CVE-2026-3234", "lastModified": "2026-11-06T19:17:49.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3234", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T13:15:10.416041Z", "version": "2.0.3"}}]}, "published": "2026-03-12T11:15:57.147", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-3234"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442889"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Coty Sutherland (@csutherl) (IBM) for reporting this issue.", "bugzilla": {"description": "mod_proxy_cluster: apache mod_proxy_cluster: Response body corruption via CRLF injection", "id": "2442889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442889"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the MCMP protocol port (typically 6666) for systems running Apache mod_proxy_cluster. Configure firewall rules to limit inbound connections to this port only from trusted internal or management networks. This action reduces the attack surface by preventing unauthorized remote access to the vulnerable service. A service reload or restart may be required for firewall changes to take full effect."}, "name": "CVE-2026-3234", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mod_proxy_cluster", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mod_proxy_cluster", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "jbcs-httpd24-mod_proxy_cluster", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "mod_proxy_cluster", "product_name": "Red Hat JBoss Core Services"}], "public_date": "2026-02-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3234\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3234"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "product": "mod_proxy_cluster", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-16T02:47:54.353916+00:00", "value": {"mitigation_remediation": ["Restrict network access to the MCMP protocol port (typically 6666) for systems running Apache mod_proxy_cluster, configuring firewall rules to limit inbound connections to trusted internal or management networks.", "Apply the latest Red\u00a0Hat security updates for Red\u00a0Hat Enterprise Linux 9/10 and Red\u00a0Hat JBoss Core Services to patch the vulnerable mod_proxy_cluster module.", "Monitor inbound MCMP traffic and system logs for anomalous connections or unexpected response content to detect potential exploitation attempts."], "summary": {"action": "Apply Workaround", "impact": "Corrupted response body via CRLF injection leading to potential information disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Red\u00a0Hat Enterprise Linux 9 and 10 as well as Red\u00a0Hat JBoss Core Services, all of which ship with mod_proxy_cluster. Any system running these products and exposing the MCMP protocol (typically port 6666) is at risk. Specific product versions are not enumerated in the CNA data; however, all current releases of the affected products include the vulnerable module unless patched by Red\u00a0Hat.", "description_and_impact": "CVE-2026-3234 identifies a flaw in Apache mod_proxy_cluster where a carriage return line feed (CRLF) injection in the decodeenc() function allows a remote attacker to bypass input validation. The attacker can inject CRLF sequences into the cluster configuration, corrupting the response body of INFO endpoint responses. This does not provide execution privileges but can expose manipulated data or create confusion in downstream components. The CVSS score of 4.3 indicates moderate severity, reflecting limited impact confined to the INFO endpoint and no authenticated privileges.", "risk_and_exploitability": "Exploitation requires network access to the MCMP protocol port and does not require authentication, but the EPSS score of less than 1% indicates a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting it is not widely exploited in the wild. The primary attack vector is remote network traffic targeting the open MCMP port, which can be mitigated by restricting inbound connections to trusted internal or management networks. Without such controls, an attacker could inject CRLF sequences and corrupt INFO responses, potentially revealing manipulated configuration data or causing unintended behavior in cluster communication."}}}}, "created": "2026-03-06T15:18:27.881112+00:00", "updated": "2026-04-16T03:00:09.179382+00:00", "vendors": ["apache", "apache$PRODUCT$mod_proxy_cluster"]}