CVE-2026-28780
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
CVSS Score
9.8
EPSS Score
1.4%
EPSS Percentile
69th
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
| CWE | CWE-122 |
| Vendor | apache software foundation |
| Product | apache http server |
| Published | May 5, 2026 |
| Last Updated | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache http server
Be the first to know when new critical vulnerabilities affecting apache software foundation apache http server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache HTTP Server
0 ≤ 2.4.66
References
httpd.apache.org: https://httpd.apache.org/security/vulnerabilities_24.html openwall.com: http://www.openwall.com/lists/oss-security/2026/05/05/9 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-28780 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2466913 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27200 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47046 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21433 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22140 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36846 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36831 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36373 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21391 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27201