Httpd: CWE-122 Heap-based Buffer Overflow in Apache Software Foundation Apache HTTP Server (CVE-2026-28780)
CVE-2026-28780 is a critical heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. This flaw allows a malicious AJP server to send crafted messages that cause mod_proxy_ajp to write four attacker-controlled bytes beyond the end of a heap buffer. The vulnerability affects Apache HTTP Server versions through 2.4.66. An official fix is available in version 2.4.67. Users are strongly advised to upgrade to this version to mitigate the risk.
AI Analysis
Technical Summary
The vulnerability CVE-2026-28780 involves a heap-based buffer overflow in the mod_proxy_ajp component of Apache HTTP Server. When mod_proxy_ajp connects to a malicious AJP server, the server can send a specially crafted AJP message that causes mod_proxy_ajp to write four bytes beyond the allocated heap buffer boundary. This can lead to arbitrary code execution. The issue affects all Apache HTTP Server versions up to and including 2.4.66. The Apache Software Foundation has released version 2.4.67 to address this vulnerability. Red Hat has also issued advisories and updates for their JBoss Core Services Apache HTTP Server packages to fix this issue.
Potential Impact
Successful exploitation of this vulnerability can result in arbitrary code execution with the privileges of the Apache HTTP Server process. This can lead to full compromise of the affected server. The CVSS v3.1 base score is 9.8 (critical), reflecting the high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
An official patch is available in Apache HTTP Server version 2.4.67. Users should upgrade to this version to remediate the vulnerability. Red Hat has released updated packages for their JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 that include the fix. Applying these updates will mitigate the risk. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Therefore, upgrading to the fixed version is the recommended remediation.
Httpd: CWE-122 Heap-based Buffer Overflow in Apache Software Foundation Apache HTTP Server (CVE-2026-28780)
Description
CVE-2026-28780 is a critical heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. This flaw allows a malicious AJP server to send crafted messages that cause mod_proxy_ajp to write four attacker-controlled bytes beyond the end of a heap buffer. The vulnerability affects Apache HTTP Server versions through 2.4.66. An official fix is available in version 2.4.67. Users are strongly advised to upgrade to this version to mitigate the risk.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-28780 involves a heap-based buffer overflow in the mod_proxy_ajp component of Apache HTTP Server. When mod_proxy_ajp connects to a malicious AJP server, the server can send a specially crafted AJP message that causes mod_proxy_ajp to write four bytes beyond the allocated heap buffer boundary. This can lead to arbitrary code execution. The issue affects all Apache HTTP Server versions up to and including 2.4.66. The Apache Software Foundation has released version 2.4.67 to address this vulnerability. Red Hat has also issued advisories and updates for their JBoss Core Services Apache HTTP Server packages to fix this issue.
Potential Impact
Successful exploitation of this vulnerability can result in arbitrary code execution with the privileges of the Apache HTTP Server process. This can lead to full compromise of the affected server. The CVSS v3.1 base score is 9.8 (critical), reflecting the high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
An official patch is available in Apache HTTP Server version 2.4.67. Users should upgrade to this version to remediate the vulnerability. Red Hat has released updated packages for their JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 that include the fix. Applying these updates will mitigate the risk. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Therefore, upgrading to the fixed version is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:21391
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-33007","CVE-2026-33857","CVE-2026-34032","CVE-2026-34059"]
- Cvss Version
- null
Threat ID: 6a18ab6fe29bf47b502887d8
Added to database: 05/28/2026, 20:54:07 UTC
Last enriched: 07/15/2026, 16:00:03 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 185
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.