{
  "threat_severity" : "Important",
  "public_date" : "2026-06-08T15:11:12Z",
  "bugzilla" : {
    "description" : "httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server",
    "id" : "2486402",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2486402"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-835",
  "details" : [ "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.\nThis issue affects undefined: from 2.4.0 through 2.4.67.\nUsers are recommended to upgrade to version 2.4.68, which fixes the issue.", "A flaw was found in the `mod_proxy_ftp` module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol (FTP) server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service (DoS) for the affected server." ],
  "statement" : "A loop with an unreachable exit condition flaw was found in the mod_proxy_ftp module of the Apache HTTP Server. A remote attacker could exploit this vulnerability by tricking the server into connecting to a malicious or compromised backend FTP server, causing the proxy_ftp_handler component to enter an infinite loop. This results in CPU exhaustion and a denial of service (DoS) condition on the affected system.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-01T00:00:00Z",
    "advisory" : "RHSA-2026:34109",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "httpd-0:2.4.63-13.el10_2.4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42828",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "httpd:2.4-8100020260714175253.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:41906",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "httpd-0:2.4.62-13.el9_8.5"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25042",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "httpd-main-2.4.68-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Affected",
    "package_name" : "httpd",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "httpd",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-44186\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44186\nhttps://httpd.apache.org/security/vulnerabilities_24.html" ],
  "name" : "CVE-2026-44186",
  "mitigation" : {
    "value" : "To mitigate this issue, you can disable the `mod_proxy_ftp` module if your environment does not require it.\n#### **Step 1: Disable the Module**\nOpen your Apache HTTP Server configuration file (commonly located at `/etc/httpd/conf.modules.d/00-proxy.conf` or `/etc/httpd/conf/httpd.conf`) and comment out or remove the following line:\n```\n# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so\n```\n#### **Step 2: Restart the Service**\nRestart the `httpd` service to apply the configuration changes:\n```\nsystemctl restart httpd\n```\n**Note:** Disabling this module may impact applications or services that rely on Apache's FTP proxy functionality.",
    "lang" : "en:us"
  },
  "csaw" : false
}