Bug 2442889 (CVE-2026-3234)

Summary: CVE-2026-3234 mod_proxy_cluster: mod_proxy_cluster: Response body corruption via CRLF injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: csutherl, jclere, pjindal, plodge, szappis, vchlup
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2442892    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-26 00:19:37 UTC 
CRLF injection in  mod_proxy_cluster's decodeenc() function allows attackers to bypass input validation and inject CRLF sequences into cluster configuration, resulting in response body corruption in INFO endpoint responses.

Exploit requires network access to the MCMP protocol port (typically port 6666, usually restricted to internal/management networks). No authentication required due to validation bypass. Attacker must be able to send MCMP CONFIG messages.