CVE-2026-28780
Severity CVSS v4.0:
Pending analysis
Type:
CWE-122
Heap-based Buffer Overflow
Publication date:
05/05/2026
Last modified:
05/05/2026
Description
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.<br />
If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.<br />
<br />
This issue affects Apache HTTP Server: through 2.4.66.<br />
<br />
Users are recommended to upgrade to version 2.4.67, which fixes the issue.