Vulnerability · Published May 5, 2026 · Assigned by apache
CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Critical 9.8
In plain English
A critical-severity heap buffer overflow in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | httpd | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | httpd | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | httpd | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | httpd-core | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:9 | httpd-core | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | httpd-devel | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | httpd-devel | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | httpd-devel | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | httpd-filesystem | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | httpd-filesystem | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | httpd-manual | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | httpd-manual | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | httpd-manual | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | httpd-tools | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | httpd-tools | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | httpd-tools | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:8 | mod_http2 | 1.15.7-10.module_el8.10.0+4185+0955a0d7.5 | ALSA-2026:22140 |
| AlmaLinux:10 | mod_ldap | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | mod_ldap | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | mod_ldap | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | mod_lua | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:9 | mod_lua | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 | ALSA-2026:22140 |
| AlmaLinux:10 | mod_proxy_html | 1:2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | mod_proxy_html | 1:2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | mod_session | 2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | mod_session | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | mod_session | 2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| AlmaLinux:10 | mod_ssl | 1:2.4.63-13.el10_2.1 | ALSA-2026:21433 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:22140 |
| AlmaLinux:9 | mod_ssl | 1:2.4.62-13.el9_8.1 | ALSA-2026:21391 |
| Alpine:v3.20 | apache2 | 2.4.67-r0 | ALPINE-CVE-2026-28780 |
| Alpine:v3.21 | apache2 | 2.4.67-r0 | ALPINE-CVE-2026-28780 |
| Alpine:v3.22 | apache2 | 2.4.67-r0 | ALPINE-CVE-2026-28780 |
| Alpine:v3.23 | apache2 | 2.4.67-r0 | ALPINE-CVE-2026-28780 |
| Alpine:v3.24 | apache2 | 2.4.67-r0 | ALPINE-CVE-2026-28780 |
| Debian:12 | apache2 | 2.4.67-1~deb12u2 | DEBIAN-CVE-2026-28780 |
| Debian:13 | apache2 | 2.4.67-1~deb13u2 | DEBIAN-CVE-2026-28780 |
| Debian:14 | apache2 | 2.4.67-1 | DEBIAN-CVE-2026-28780 |
| Rocky Linux:10 | httpd | 0:2.4.63-13.el10_2.1 | RLSA-2026:21433 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1840+b070a976.1 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4 | RLSA-2026:22140 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3 | RLSA-2026:22140 |
| Rocky Linux:9 | httpd | 0:2.4.62-13.el9_8.1 | RLSA-2026:21391 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1 | RLSA-2026:22140 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 | RLSA-2026:22140 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0 | RLSA-2026:22140 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3 | RLSA-2026:22140 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4 | RLSA-2026:22140 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2 | RLSA-2026:22140 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 | RLSA-2026:22140 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.20 | UBUNTU-CVE-2026-28780 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu8.12 | UBUNTU-CVE-2026-28780 |
| Ubuntu:25.10 | apache2 | 2.4.64-1ubuntu3.4 | UBUNTU-CVE-2026-28780 |
| Ubuntu:26.04:LTS | apache2 | 2.4.66-2ubuntu2.1 | UBUNTU-CVE-2026-28780 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 0 – through 2.4.66 |
Weakness: CWE-122, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/05/05/9
- https://access.redhat.com/security/cve/CVE-2026-28780 vdb-entry, x_refsource_REDHAT
- RHBZ#2466913 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:27200 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:47046 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21433 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22140 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36846 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36831 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36373 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67152 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66323 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62165 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21391 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27201 vendor-advisory, x_refsource_REDHAT