Description

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-01T17:17:29.923Z",
  "pubdate": "2026-10-01T17:17:29.923Z",
  "executiveSummary": "A critical NULL pointer dereference vulnerability exists within the mod_xml2enc module of the Apache HTTP Server, identified as a denial-of-service (DoS) condition.\nThe vulnerability manifests when the server processes a proxied response from an untrusted backend that specifies a charset triggering an incomplete conversion process.\nThis flaw allows an unauthenticated remote attacker acting as or controlling a backend server to crash the Apache HTTP process, leading to service unavailability.\nThe vulnerability affects all platforms running Apache HTTP Server versions prior to 2.4.69.\nRisk implications include significant degradation of service availability. Exploitation does not require authenticated access to the target Apache server itself, as the trigger occurs during the standard proxying workflow of backend-supplied content.\nDefensive efforts should prioritize immediate patching to the identified secure version to prevent exploitation of the process crash mechanism.",
  "technicalDetails": "The vulnerability originates in the mod_xml2enc module, which is responsible for detecting and converting character sets in XML content passed through the Apache HTTP Server proxy.\nThe root cause is a NULL pointer dereference occurring during character encoding conversion. Specifically, when the module attempts to process a proxied response containing a charset that undergoes a partial but unsuccessful conversion, the internal state management of the module fails to handle the error condition gracefully.\nUnder normal operating conditions, mod_xml2enc utilizes libxml2 to handle encoding transformations. When the conversion logic encounters an unexpected failure state midway through the transformation process, the pointer tracking the translation state or output buffer may be improperly cleared or left uninitialized. If the subsequent error-handling routines attempt to reference this memory location, the application triggers a NULL pointer dereference.\nThe attack flow begins when an attacker, positioned as a backend server or capable of influencing the headers returned by a backend server, provides a specially crafted HTTP response to the Apache reverse proxy. This response must define a charset that induces the specific error-handling path within mod_xml2enc. Upon receiving the response, the Apache HTTP Server module initiates the conversion process. When the conversion partially succeeds and then encounters the trigger condition, the internal control flow reaches the vulnerable code branch where the dereference occurs.\nBecause Apache HTTP Server often utilizes a process-per-request or worker-thread architecture, the unhandled exception causes the immediate termination of the child process or thread handling the request. Repeated triggers of this vulnerability enable an attacker to effectively exhaust the server's process pool, resulting in a persistent Denial of Service (DoS) for legitimate users.\nThe vulnerability is platform-agnostic and relies entirely on the interplay between the proxy configuration and the backend server's response. No specific authentication or high-level privileges are required on the Apache server itself to trigger this condition, as the exploitation is automated via the proxying mechanism. Affected versions include all releases of Apache HTTP Server prior to 2.4.69. The absence of adequate input validation and error checking on the conversion state machine within mod_xml2enc constitutes the primary technical defect enabling this exploitation vector."
}