A heap-based buffer overflow in the mod_proxy_ajp component allows a malicious AJP server to send an crafted message that causes the server to write four attacker‑controlled bytes beyond the end of a heap buffer. This flaw is classified as CWE‑122 and can lead to manipulation of server memory that may execute arbitrary code.

The vulnerability affects all Apache HTTP Server releases up through version 2.4.66. The affected product is the Apache HTTP Server, as distributed by the Apache Software Foundation.

The attack requires control of an AJP server that the web server connects to. Although the EPSS score is not provided and the vulnerability is not listed in CISA KEV, the nature of a heap‑overflow flaw suggests it could be exploitable by remote actors if they can influence the AJP communication channel. The lack of a publicly available CVSS score and KEV listing limits the precise assessment of severity, but the weakness type implies a high risk if the conditions for exploitation are met.