Out-of-bounds Read in Apache HTTP Server mod_proxy_ajp

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: Apache Software Foundation

Description

Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-05-04

Generated

2026-07-07

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33857

Affected Vendors & Products

Vendor	Product	Version / Range
apache	http_server	to 2.4.67 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the mod_proxy_ajp module of the Apache HTTP Server. It affects versions up to 2.4.66 and allows reading memory outside the intended buffer boundaries.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of information because it allows reading data beyond the intended memory area. However, it does not affect integrity or availability.

Mitigation Strategies

Users are recommended to upgrade Apache HTTP Server to version 2.4.67, which fixes the out-of-bounds read vulnerability in mod_proxy_ajp.

Hi! I’m here to help you understand CVE-2026-33857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70