CVE-2026-28780: Apache HTTP Server Buffer Overflow Flaw

CVE-2026-28780 Overview

CVE-2026-28780 is a heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. When mod_proxy_ajp connects to a malicious Apache JServ Protocol (AJP) backend, the server can return a crafted AJP message that causes the proxy module to write four attacker-controlled bytes past the end of a heap-allocated buffer. The flaw is tracked as CWE-122 and affects Apache HTTP Server releases through 2.4.66. Apache addressed the issue in version 2.4.67.

Critical Impact

A malicious or compromised AJP backend can corrupt heap memory in the front-end Apache HTTP Server, enabling potential remote code execution, process crash, or data tampering on the proxy host.

Affected Products

• Apache HTTP Server versions through 2.4.66 with mod_proxy_ajp enabled
• Reverse proxy deployments forwarding requests to AJP backends (for example, Tomcat or JBoss)
• Any Linux, Windows, or Unix distribution shipping the affected Apache HTTP Server build

Discovery Timeline

• 2026-05-05 - CVE-2026-28780 published to the National Vulnerability Database
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-28780

Vulnerability Analysis

The vulnerability resides in mod_proxy_ajp, the Apache module responsible for proxying HTTP requests to AJP-speaking application servers. The module parses response messages received from the upstream AJP server and copies portions of those messages into heap-allocated buffers. Insufficient validation of length or offset fields in an attacker-controlled AJP response causes the module to write four bytes beyond the allocated buffer boundary. The exploitation precondition requires mod_proxy_ajp to communicate with a malicious AJP server, which can occur through DNS poisoning, network-level redirection, server-side request forgery against backend selection logic, or compromise of an internal application server.

Root Cause

The defect is classified as CWE-122, heap-based buffer overflow. The AJP response handler trusts size or count fields supplied by the backend without bounding them against the destination buffer size. As a result, a crafted AJP packet drives a four-byte out-of-bounds write into adjacent heap metadata or neighboring allocations. Heap layout in httpd worker processes places these structures near connection state and request pool data, making the four-byte primitive useful for corrupting pointers or function references.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction on the Apache front-end. An attacker who controls or impersonates an AJP backend returns a malformed AJP message in response to any proxied request. The four attacker-controlled bytes overwrite heap data in the Apache worker, which can be leveraged for arbitrary code execution within the httpd process context, denial of service through worker crashes, or manipulation of request handling state. Refer to the Apache HTTP Server Security Vulnerabilities advisory and the Openwall OSS-Security mailing list post for vendor-confirmed technical context.

Detection Methods for CVE-2026-28780

Indicators of Compromise

• Unexpected httpd worker crashes, segmentation faults, or core dumps correlated with AJP backend traffic
• AJP responses originating from IP addresses or hosts not in the documented backend inventory
• Anomalous outbound connections from mod_proxy_ajp to TCP port 8009 on hosts outside the trusted application tier
• Apache error_log entries referencing malformed AJP messages or proxy read failures

Detection Strategies

• Inventory all Apache HTTP Server instances and identify those with mod_proxy_ajp loaded by inspecting httpd.conf and included configuration fragments
• Compare installed Apache versions against 2.4.67 using package managers or the httpd -v command
• Monitor AJP traffic flows between proxy and backend hosts for unexpected source addresses or message structures
• Alert on httpd process termination, restart loops, or coredump generation in observability pipelines

Monitoring Recommendations

• Forward Apache error_log and access_log data into a centralized logging or SIEM platform for retrospective analysis
• Capture network telemetry for TCP port 8009 and review for protocol anomalies or unauthorized peers
• Implement file integrity monitoring on Apache configuration files and module directories to detect tampering
• Track host-level process crash events and correlate them with proxied request volumes

How to Mitigate CVE-2026-28780

Immediate Actions Required

• Upgrade Apache HTTP Server to version 2.4.67 or later on all systems where mod_proxy_ajp is loaded
• Restrict AJP backend connectivity to known-good application servers using firewall rules or network segmentation
• Audit ProxyPass and ProxyPassMatch directives that target ajp:// URLs and validate destination hostnames
• Disable mod_proxy_ajp on systems that do not require AJP proxying until patching is complete

Patch Information

Apache HTTP Server 2.4.67 resolves CVE-2026-28780 by correcting the AJP response parsing logic in mod_proxy_ajp. Administrators should obtain the patched release directly from the Apache HTTP Server Security Vulnerabilities page or from their operating system vendor as soon as builds are available. After upgrading, restart the httpd service and confirm the running version reports 2.4.67 or higher.

Workarounds

• Remove or comment out the LoadModule proxy_ajp_module directive in Apache configuration if AJP proxying is not in use
• Enforce mutual TLS or IPsec between the Apache proxy and AJP backends to prevent backend impersonation
• Place AJP backends on a dedicated, isolated network segment that excludes untrusted systems
• Apply egress filtering on Apache hosts to allow AJP connections only to documented backend IP addresses

# Configuration example: disable mod_proxy_ajp until patching
# In httpd.conf or conf.modules.d/00-proxy.conf
# LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

# Verify the running Apache version after upgrade
httpd -v

# Restrict AJP egress to a known backend (Linux iptables example)
iptables -A OUTPUT -p tcp --dport 8009 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8009 -j DROP