What’s Vulnerable › Vulnerabilities

CVE-2026-3234: Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-12 · updated 2026-06-17
• Weakness: CWE-93

Description

A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.

Affected products

• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat JBoss Core Services: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-3234
• https://bugzilla.redhat.com/show_bug.cgi?id=2442889

Get alerted when CVE-2026-3234 or the next vulnerability affects your stack