Remote code execution via backend-controlled handler confusion

Handler confusion in Apache HTTP Server 2.4.59 and earlier allows remote attackers to disclose data, make proxy requests, or run scripts via backend headers. During a backend-driven internal redirect, ap_internal_redirect_handler copies the prior Content-Type into a new request, and ap_invoke_handler treats it as the handler name. Exploitation requires control of backend response Content-Type and Location headers, such as through response-header injection or SSRF, and can expose server data, initiate outbound requests, or invoke local handlers.