BIT-apache-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Q: Which deployments are exposed to this issue?

Apache HTTP Server deployments using mod_proxy_ajp are exposed when that module connects to an AJP server. The affected Apache HTTP Server versions are through 2.4.66.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to control, or cause mod_proxy_ajp to connect to, a malicious AJP server. That server can return a crafted AJP message that triggers a heap-based buffer overflow.

Q: Is authentication or user interaction required?

No. The supplied severity vector indicates network attack access with low attack complexity and no privileges or user interaction required.

Q: What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.67, which fixes the issue.

Published May 5, 2026

Updated

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Affected Software

1 affected component

Apache HTTP Server<=2.4.66

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.67

Event History

May 5, 2026

CVE Published

via OSV·09:29 PM

Data Sourced

via OSV·09:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server deployments using mod_proxy_ajp are exposed when that module connects to an AJP server. The affected Apache HTTP Server versions are through 2.4.66.

What does an attacker need to exploit the vulnerability?

An attacker needs to control, or cause mod_proxy_ajp to connect to, a malicious AJP server. That server can return a crafted AJP message that triggers a heap-based buffer overflow.

Is authentication or user interaction required?

No. The supplied severity vector indicates network attack access with low attack complexity and no privileges or user interaction required.

What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.67, which fixes the issue.

BIT-apache-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is authentication or user interaction required?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is authentication or user interaction required?

What is the recommended remediation?