CVE-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to modproxyajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.67Patch CVE-2026-28780
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28780?
CVE-2026-28780 is classified as a high severity vulnerability due to its potential for a buffer overflow exploit.
How do I fix CVE-2026-28780?
To fix CVE-2026-28780, update your Apache HTTP Server to version 2.4.67 or later.
What causes CVE-2026-28780?
CVE-2026-28780 is caused by a heap-based buffer overflow in the mod_proxy_ajp module when connected to a malicious AJP server.
Who is affected by CVE-2026-28780?
CVE-2026-28780 affects users of Apache HTTP Server versions up to 2.4.66 that utilize the mod_proxy_ajp module.
What are the potential consequences of CVE-2026-28780?
Exploitation of CVE-2026-28780 could lead to remote code execution or denial of service on affected systems.