CVE-2026-28780
Awaiting Analysis Awaiting Analysis - Queue
Heap-based Buffer Overflow in Apache HTTP Server mod_proxy_ajp

Publication date: 2026-05-05

Last updated on: 2026-05-06

Assigner: Apache Software Foundation

Description
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-05
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-06
EPSS Evaluated
2026-06-15
NVD
CVE-2026-28780
EUVD
EUVD-2026-27506
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache http_server to 2.4.67 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based buffer overflow in the mod_proxy_ajp module of the Apache HTTP Server. It occurs when mod_proxy_ajp connects to a malicious AJP server that sends a specially crafted AJP message. This message causes mod_proxy_ajp to write 4 attacker-controlled bytes beyond the end of a heap buffer, potentially leading to memory corruption.

Impact Analysis

The impact of this vulnerability is that an attacker controlling a malicious AJP server can exploit the buffer overflow to corrupt memory in the Apache HTTP Server process. This could lead to unpredictable behavior such as crashes, denial of service, or potentially arbitrary code execution depending on the environment and exploitation conditions.

Mitigation Strategies

Users are recommended to upgrade Apache HTTP Server to version 2.4.67, which fixes the heap-based buffer overflow vulnerability in mod_proxy_ajp.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart