CVE-2026-3234 Details
Description
A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.
A CRLF injection vulnerability has been identified in the Apache mod_proxy_cluster module, specifically within the decodeenc() function. This flaw allows remote attackers to bypass input validation by injecting CRLF sequences into the cluster configuration. As a result, the response body of INFO endpoint responses can be corrupted. Exploitation of this vulnerability requires network access to the MCMP protocol port, typically 6666, but does not require authentication.
It is recommended to restrict network access to the MCMP protocol port (usually 6666) for systems running Apache mod_proxy_cluster. Configure firewall rules to allow inbound connections to this port only from trusted internal or management networks. A service reload or restart may be necessary for firewall changes to take effect.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-3234 | [email protected] | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2442889 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | New CVE Received | [email protected] |