CVE-2026-28780
Critical · 9.8CVSS
9.8
EPSS
1.6%
Published
May 5, 2026
CISA due date
—
The record
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.66-160000.2.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.67-1.1 |
Related vulnerabilities
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2
- CVE-2026-33007 A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and… Also affects apache2
- CVE-2026-33523 HTTP response splitting vulnerability in multiple Apache HTTP Server modules with… Also affects apache2
- CVE-2026-23918 Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. Also affects apache2
- CVE-2026-29169 A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may… Also affects apache2
- CVE-2026-33006 A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of… Also affects apache2
- CVE-2026-33857 Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-34032 Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. Also affects apache2