This vulnerability is an off‑by‑one out‑of‑bounds read in the mod_proxy_ajp module of the Apache HTTP Server. The flaw allows an attacker to read memory beyond a buffer boundary, potentially exposing sensitive data that resides in the process's memory space. The weakness is classified as CWE-125 and can lead to the disclosure of confidential information to a remote attacker.

All installations of Apache HTTP Server up to and including version 2.4.66 are affected. The most recent version that contains the fix is 2.4.67.

The vulnerability is publicly documented but has no reported exploitation instances. The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, indicating that known exploitation is either absent or low. The attack vector is likely remote, mediated through AJP requests received by the server; this inference is based on the affected mod_proxy_ajp component.