LiveActive security incident?Get immediate response
CVE Record

CVE-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Apache HTTP Server through 2.4.66 has a critical memory corruption flaw in mod_proxy_ajp. The risk applies when Apache connects to a malicious or compromised AJP backend, which can send a crafted response and overwrite heap memory. Apache recommends upgrading to 2.4.67.

Executive priority

Treat as urgent for environments using Apache as an AJP reverse proxy. The severity is critical, but business exposure depends on whether mod_proxy_ajp is enabled and whether AJP backends could be malicious or compromised.

Technical view

CVE-2026-28780 is a heap-based buffer overflow in mod_proxy_ajp, specifically ajp_msg_check_header(). A malicious AJP server can cause mod_proxy_ajp to write four attacker-controlled bytes beyond a heap buffer. CVSS 3.1 is 9.8 with network attack vector and no required privileges or user interaction.

Likely exposure

Exposure is most likely where Apache HTTP Server through 2.4.66 uses mod_proxy_ajp and trusts AJP backend servers. Systems not using mod_proxy_ajp, or not proxying to AJP backends, are not clearly exposed based on the provided evidence.

Exploitation context

The supplied sources do not show CISA KEV listing or confirmed active exploitation. The described condition requires mod_proxy_ajp to connect to a malicious AJP server, so compromise or control of an AJP backend is central to the risk.

Researcher notes

The CVE record and Apache advisory describe a four-byte heap overwrite from a malicious AJP response. Provided metadata has limited affected-product detail, so validation should rely on actual module configuration and vendor package advisories rather than assuming all Apache deployments are exploitable.

Mitigation direction

  • Upgrade Apache HTTP Server to 2.4.67 or later.
  • Review Red Hat advisories for distribution-specific fixed packages.
  • Disable mod_proxy_ajp where AJP proxying is not required.
  • Restrict Apache-to-AJP backend connectivity to trusted systems only.
  • Check vendor guidance before applying non-upgrade mitigations.

Validation and detection

  • Inventory Apache HTTP Server versions across internet-facing and internal systems.
  • Confirm whether mod_proxy_ajp is loaded or configured.
  • Identify Apache instances proxying to AJP backends.
  • Verify package versions against Apache and Red Hat advisories.
  • Document systems already upgraded to 2.4.67 or vendor-fixed builds.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-122: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-787: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-28780 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
8Timeline events
3ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADP
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-28780Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineapache

    reported

  2. Source timelineapache

    reported by 2nd finder

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. Source timelineapache

    reported by 3rd finder

  5. ADP timelineredhat-SADP

    Made public.

  6. CVE publishedCVE Program

    The CVE record was published.

  7. ADP timelineredhat-SADP

    Reported to Red Hat.

  8. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
redhat-SADPApache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow
other:Red Hat severity ratingcvssV3_1
  • 2026-05-05T22:01:12.666Z: Reported to Red Hat.
  • 2026-05-05T21:29:41.527Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache HTTP Server0unaffected
Weakness

CWE details

CWE-122CWE-787

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-122 · source CWE mapping

Heap-based Buffer Overflow

Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-787 · source CWE mapping

Out-of-bounds Write

Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs