https://www.apache.org/security/asf-httpoxy-response.txt
http://svn.apache.org/viewvc?view=revision&revision=1753228
http://svn.apache.org/viewvc?view=revision&revision=1753229

--- docs/conf/httpd.conf.in	2016/07/18 14:00:30	1753227
+++ docs/conf/httpd.conf.in	2016/07/18 14:07:00	1753228
@@ -283,6 +283,15 @@
     Require all granted
 </Directory>
 
+<IfModule headers_module>
+    #
+    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
+    # backend servers which have lingering "httpoxy" defects.
+    # 'Proxy' request header is undefined by the IETF, not listed by IANA
+    #
+    RequestHeader unset Proxy early
+</IfModule>
+
 <IfModule mime_module>
     #
     # TypesConfig points to the file containing the list of mappings from
--- server/util_script.c	2016/07/18 14:00:30	1753227
+++ server/util_script.c	2016/07/18 14:07:00	1753228
@@ -186,6 +186,14 @@
         else if (!strcasecmp(hdrs[i].key, "Content-length")) {
             apr_table_addn(e, "CONTENT_LENGTH", hdrs[i].val);
         }
+        /* HTTP_PROXY collides with a popular envvar used to configure
+         * proxies, don't let clients set/override it.  But, if you must...
+         */
+#ifndef SECURITY_HOLE_PASS_PROXY
+        else if (!ap_cstr_casecmp(hdrs[i].key, "Proxy")) {
+            ;
+        }
+#endif
         /*
          * You really don't want to disable this check, since it leaves you
          * wide open to CGIs stealing passwords and people viewing them