PatchSiren cyber security CVE debrief

CVE-2026-28780 Apache CVE debrief

CVE-2026-28780 is a critical vulnerability in Apache HTTP Server's mod_proxy_ajp. A malicious AJP server can send a crafted AJP message to cause a heap-based buffer overflow, allowing the attacker to write 4 controlled bytes after the buffer end. This issue affects Apache HTTP Server through version 2.4.66 and is fixed in version 2.4.67. The vulnerability has a CVSS score of 9.8 and is considered critical. Users of affected versions should upgrade to 2.4.67 as soon as possible.

Vendor: Apache
Product: HTTP Server
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-05
Original CVE updated: 2026-09-14
Advisory published: 2026-05-05
Advisory updated: 2026-09-14

Who should care

Apache HTTP Server users, administrators of web servers, and security teams should be aware of this critical vulnerability. The vulnerability's high CVSS score and potential for remote exploitation make it a priority for patching. Affected users should assess their exposure and apply the fix promptly.

Technical summary

The vulnerability is a heap-based buffer overflow in mod_proxy_ajp of Apache HTTP Server. When mod_proxy_ajp connects to a malicious AJP server, that server can send a crafted AJP message back to mod_proxy_ajp, causing it to write 4 attacker-controlled bytes after the end of a heap-based buffer. This issue is particularly severe due to its potential for remote exploitation and high CVSS score of 9.8. The CWE-122 and CWE-787 weaknesses are associated with this vulnerability.

Defensive priority

This vulnerability should be prioritized for immediate patching due to its critical severity and potential for remote exploitation. Affected Apache HTTP Server users should upgrade to version 2.4.67 as soon as possible to mitigate the risk.

Recommended defensive actions

Upgrade Apache HTTP Server to version 2.4.67 or later
Assess exposure and prioritize patching for affected versions
Monitor for potential exploitation attempts
Review and update incident response plans
Apply compensating controls if immediate patching is not feasible

Evidence notes

The CVE-2026-28780 vulnerability is well-documented in the NVD and CVE records. Multiple sources, including Apache and Red Hat, provide information on the vulnerability and its fix. The evidence suggests a high level of confidence in the vulnerability's existence and impact.

Sources and references

Verified primary and authoritative sources

CVE-2026-28780 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-28780

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-28780 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28780

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://httpd.apache.org/security/vulnerabilities_24.html

[email protected] - Release Notes, Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:21391

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:21433

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:22140

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:27200

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:27201

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.