by Kastro CVE-2026-28780
Apache Software Foundation Apache HTTP Server — Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
Description · from the CVE record
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Affected
ProductAffectedFixed inSource
Apache HTTP Server≤ 2.4.66–CNA
JBoss Core Services for RHEL 8see advisory0:2.4.62-13.el8jbcsredhat-SADP
JBoss Core Services on RHEL 7see advisory0:2.4.62-13.el7jbcsredhat-SADP
Red Hat Enterprise Linux 10see advisory0:2.4.63-13.el10_2.1redhat-SADP
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory0:2.4.63-1.el10_0.4redhat-SADP
Red Hat Enterprise Linux 8see advisory8100020260519200905.489197e6redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory8040020260702193120.522a0ee4redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory8040020260702193120.522a0ee4redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020260702195216.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory8060020260702195216.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory8080020260702200145.63b34585redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory8080020260702200145.63b34585redhat-SADP
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total