CVE-2026-28780: CWE-122 Heap-based Buffer Overflow in Apache Software Foundation Apache HTTP Server
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
AI Analysis
Technical Summary
CVE-2026-28780 is a heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. When mod_proxy_ajp connects to a malicious AJP server, the server can send a malicious AJP message that causes mod_proxy_ajp to write 4 attacker-controlled bytes beyond the end of a heap buffer. This memory corruption can lead to arbitrary code execution. The vulnerability affects Apache HTTP Server versions through 2.4.66. Red Hat has released security advisories and updates, including for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4, which address this issue. Users are recommended to upgrade to version 2.4.67 or apply vendor-provided patches.
Potential Impact
Successful exploitation of this vulnerability can lead to arbitrary code execution with the privileges of the Apache HTTP Server process. This poses a critical risk to affected systems, potentially allowing attackers to execute malicious code remotely without authentication. The CVSS v3.1 base score is 9.8, reflecting high attack vector accessibility (network), low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in Apache HTTP Server version 2.4.67. Users should upgrade to this version to remediate the vulnerability. Red Hat has issued security advisories and updates for affected products, including Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4. Applying these vendor-provided updates will mitigate the issue. No additional mitigation steps are indicated by the vendor advisories.
CVE-2026-28780: CWE-122 Heap-based Buffer Overflow in Apache Software Foundation Apache HTTP Server
Description
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
CVSS v3.1
Score 9.8critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-28780 is a heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. When mod_proxy_ajp connects to a malicious AJP server, the server can send a malicious AJP message that causes mod_proxy_ajp to write 4 attacker-controlled bytes beyond the end of a heap buffer. This memory corruption can lead to arbitrary code execution. The vulnerability affects Apache HTTP Server versions through 2.4.66. Red Hat has released security advisories and updates, including for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4, which address this issue. Users are recommended to upgrade to version 2.4.67 or apply vendor-provided patches.
Potential Impact
Successful exploitation of this vulnerability can lead to arbitrary code execution with the privileges of the Apache HTTP Server process. This poses a critical risk to affected systems, potentially allowing attackers to execute malicious code remotely without authentication. The CVSS v3.1 base score is 9.8, reflecting high attack vector accessibility (network), low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in Apache HTTP Server version 2.4.67. Users should upgrade to this version to remediate the vulnerability. Red Hat has issued security advisories and updates for affected products, including Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4. Applying these vendor-provided updates will mitigate the issue. No additional mitigation steps are indicated by the vendor advisories.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-03-03T12:31:23.999Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-28780","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:27200","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21433","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:22140","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21391","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:27201","vendor":"Red Hat"}]
Threat ID: 69fa665ccbff5d861029ec69
Added to database: 05/05/2026, 21:51:24 UTC
Last enriched: 07/30/2026, 00:05:00 UTC
Last updated: 08/02/2026, 19:25:59 UTC
Views: 290
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.