CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Apache HTTP Server: modproxyajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajpmsggetstring)
Other sources
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: through 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.67-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.67
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34032?
CVE-2026-34032 is classified as a moderate severity vulnerability due to the potential for out-of-bounds read leading to information disclosure.
How do I fix CVE-2026-34032?
To mitigate CVE-2026-34032, upgrade Apache HTTP Server to version 2.4.67 or later.
What systems are affected by CVE-2026-34032?
CVE-2026-34032 affects Apache HTTP Server versions up to and including 2.4.66.
What are the potential impacts of CVE-2026-34032?
The potential impacts of CVE-2026-34032 include unauthorized access to sensitive information due to improper null termination.
Is there a workaround for CVE-2026-34032?
There are no known workarounds for CVE-2026-34032; upgrading to a patched version is the recommended solution.