Review reviewCritical

CVE-2026-28780

Apache Software Foundation Apache HTTP Server, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7

Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

CVSS: 9.8
EPSS: 1.38%
CISA KEV: Not listed
Published: 2026.05.06

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability1.38%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache HTTP Server, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7
Affected versions: <= 2.4.66, < 2.4.67
Fixed versions: 2.4.67

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache HTTP Server, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-122, CWE-787