Skip to main content

Apache HTTP Server CVE-2026-28780

| EUVDEUVD-2026-27506 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-05-05 apache
Buffer Overflow Apache Heap Overflow Apache Http Server Apache Software Foundation
9.8
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Compromise AJP backend server
  2. Delivery
    Apache proxies request via mod_proxy_ajp
  3. Exploit
    Malicious backend sends crafted AJP response
  4. Install
    Trigger heap buffer overflow in mod_proxy_ajp
  5. C2
    Corrupt heap metadata/pointers
  6. Execute
    Redirect execution flow
  7. Impact
    Execute arbitrary code as httpd user

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target Apache HTTP Server has mod_proxy_ajp module loaded AND configured with ProxyPass or similar directives pointing to an AJP backend server. The attacker must control or compromise the AJP backend server that Apache connects to, or perform man-in-the-middle attacks on the Apache-to-backend AJP communication channel. Standard Apache installations serving static/PHP content without reverse proxy configurations are not vulnerable. Organizations using HTTP/HTTPS reverse proxying (mod_proxy_http) instead of AJP are unaffected. Attack surface is limited to enterprise architectures deliberately implementing AJP protocol between Apache frontends and Java application server backends, most commonly Apache-to-Tomcat configurations using AJP connectors on port 8009.
Impact

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates maximum theoretical severity with network exploitation requiring no authentication or user interaction. However, multiple risk signals suggest substantially lower real-world priority. EPSS score of 0.02% (5th percentile) shows virtually no exploitation activity observed across monitored attack surfaces despite public disclosure. No CISA KEV listing exists, confirming absence of confirmed active exploitation campaigns. The critical limiting factor is deployment context: exploitation absolutely requires that the Apache server uses mod_proxy_ajp AND connects to an attacker-controlled or compromised AJP backend server. This is NOT a vulnerability in default Apache installations or standard web hosting configurations. The attack surface is restricted to environments specifically implementing AJP reverse proxy architectures, typically enterprise applications with separate web and application tiers. Organizations not using mod_proxy_ajp or not proxying to untrusted AJP backends face zero risk. For affected deployments, patch availability in 2.4.67 provides straightforward remediation path, making this a high-severity issue for the narrow affected population rather than internet-wide critical emergency despite CVSS scoring.
Exploit ScenarioDerived

An attacker operates or compromises an AJP-enabled application server (such as a malicious Tomcat instance or compromised legitimate backend). The target Apache HTTP Server is configured with mod_proxy_ajp to reverse proxy requests to this backend. When Apache forwards requests via AJP protocol, the malicious backend responds with specially crafted AJP messages containing heap overflow triggers. The 4-byte controlled write corrupts heap metadata or function pointers, redirecting execution to attacker-supplied shellcode and granting remote code execution on the Apache server with httpd process privileges. No public exploit code confirmed at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 06, 2026

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying to attacker-controlled AJP backends. Affects all versions through 2.4.66; attackers can achieve remote code execution by sending malicious AJP protocol responses that overflow a heap buffer with 4 controlled bytes. Apache released patch in version 2.4.67. Despite critical CVSS 9.8, EPSS probability remains very low (0.02%, 5th percentile) indicating minimal observed exploitation attempts, and no CISA KEV listing confirms active in-the-wild abuse. Exploitation requires specific proxy_ajp deployment configuration connecting to malicious AJP servers.

RemediationAI

Immediately upgrade Apache HTTP Server to version 2.4.67 or later, which contains the complete fix per Apache Software Foundation advisory at https://httpd.apache.org/security/vulnerabilities_24.html. For environments unable to upgrade immediately, disable mod_proxy_ajp module entirely if AJP proxy functionality is not required (in httpd.conf, comment out LoadModule proxy_ajp_module). If AJP proxying is required, implement strict network controls ensuring mod_proxy_ajp connects ONLY to trusted, authenticated AJP backend servers under your administrative control - use firewall rules, VPN tunnels, or localhost-only connections to prevent exposure to potentially malicious backends. Note that disabling mod_proxy_ajp breaks AJP-dependent applications; localhost-only restriction requires backend colocation and prevents distributed architectures. Validate that security updates from OS vendors (RHEL, Ubuntu, Debian, SUSE) incorporating Apache 2.4.67 are applied when available for your distribution.

Affected VersionsENISA

Apache HTTP Server 0 ≤2.4.66

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The mod_proxy_ajp module implements Apache JServ Protocol (AJP) reverse proxy functionality, commonly used to connect Apache HTTP Server frontends to backend application servers like Apache Tomcat. This CWE-122 heap-based buffer overflow occurs during AJP message parsing when mod_proxy_ajp processes responses from AJP backend servers. The vulnerability allows a malicious backend to craft AJP protocol messages that trigger a 4-byte write beyond allocated heap buffer boundaries. According to CPE data, the flaw exists in all Apache HTTP Server versions from earliest releases through 2.4.66, spanning potentially decades of deployments. The heap overflow primitive, while limited to 4 bytes, provides sufficient control for memory corruption attacks that can redirect execution flow to achieve arbitrary code execution with the privileges of the Apache worker process.

Know when Apache Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 8.1 HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVSS changed
May 06, 2026 - 16:22 NVD
9.8 (CRITICAL)

DescriptionCVE.org

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Executive ViewAI

Why It Matters

Apache HTTP Server versions through 2.4.66 contain a critical remote code execution vulnerability in the mod_proxy_ajp module that allows unauthenticated attackers to achieve complete system compromise through malicious AJP backend responses. Organizations running Apache as a reverse proxy to AJP application servers face immediate risk of unauthorized access and system takeover, making this a priority remediation target despite current low observed exploitation rates.

Business Impact: Severe
Compensating Controls

If immediate patching is not feasible: (1) Disable mod_proxy_ajp module if not actively required; (2) Restrict network access to AJP backend connections using firewall rules to permit only trusted application servers; (3) Implement intrusion detection signatures for malformed AJP protocol responses; (4) Monitor Apache error logs for proxy_ajp module warnings or crashes indicating exploitation attempts.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Social Media
5
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-93546 HIGH
8.8 Oct 01

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client

CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-63292 HIGH
7.5 Oct 01

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
CVE-2026-59685 HIGH
7.5 Oct 01

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28780 ADVISORY https://ubuntu.com/security/notices/USN-8239-1 ADVISORY https://vuldb.com/vuln/361235 REF http://www.openwall.com/lists/oss-security/2026/05/05/9 REF https://access.redhat.com/errata/RHSA-2026:21391 REF https://access.redhat.com/errata/RHSA-2026:21433 REF https://access.redhat.com/errata/RHSA-2026:22140 REF https://access.redhat.com/errata/RHSA-2026:27200 REF https://access.redhat.com/errata/RHSA-2026:27201 REF https://access.redhat.com/errata/RHSA-2026:36373 REF https://access.redhat.com/errata/RHSA-2026:36831 REF https://access.redhat.com/errata/RHSA-2026:36846 REF https://access.redhat.com/errata/RHSA-2026:47046 REF https://access.redhat.com/errata/RHSA-2026:62165 REF https://access.redhat.com/errata/RHSA-2026:66323 REF https://access.redhat.com/errata/RHSA-2026:67152 REF https://access.redhat.com/security/cve/CVE-2026-28780 REF https://bugzilla.redhat.com/show_bug.cgi?id=2466913 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy