Heap-based Buffer Overflow in Apache HTTP Server's mod_proxy_ajp
Summary
ALPINE-CVE-2026-28780: Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Affects apache2 versions < 2.4.67-r0. Fixed in 2.4.67-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, performance, and extensive feature set, including support for various modules. One such module, mod_proxy_ajp, allows Apache to communicate with AJP (Apache JServ Protocol) servers. However, a vulnerability has been identified in this module that could potentially compromise the server's security.
Vulnerability Detail
The vulnerability is a heap-based buffer overflow in the mod_proxy_ajp module of the Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server, that server can send a specially crafted AJP message that causes mod_proxy_ajp to write 4 bytes of attacker-controlled data beyond the end of a heap-based buffer. This could lead to arbitrary code execution or other malicious activities, posing a significant risk to the integrity and security of the affected server.
How To Fix
Minimum fixed version
2.4.67-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable mod_proxy_ajp if it is not required for their applications. This can be done by commenting out or removing the relevant configuration lines in the Apache configuration files that load the mod_proxy_ajp module.
Conclusion
The heap-based buffer overflow vulnerability in Apache HTTP Server's mod_proxy_ajp poses a serious risk to server security. Users are strongly advised to upgrade to version 2.4.67 or later to protect their systems from potential exploitation. Temporary workarounds are available, but upgrading is the most effective solution.
See every vulnerability recorded for apache2 →
FAQ
mod_proxy_ajp is an Apache module that allows communication between the Apache HTTP Server and AJP servers, facilitating the integration of web applications.
Exploiting this vulnerability could allow an attacker to execute arbitrary code on the server, potentially leading to data breaches or service disruptions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Disabling mod_proxy_ajp is a temporary workaround to mitigate the risk until an upgrade can be performed.
Detailed information can be found in the CVE database under CVE-2026-28780, as well as on the official Apache HTTP Server website.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
