CVE-2026-34032

Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

View on CVE.org
Published May 4, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: through 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Analysis

AI-generated

Technical impact

This vulnerability arises from an improper null termination in the ajp_msg_get_string function within Apache HTTP Server’s mod_proxy_ajp module, causing an out‑of‑bounds read. The over‑read can expose arbitrary memory contents of the server process, leading to information disclosure, and may trigger a crash, resulting in denial of service. The weakness is classified as CWE-125 (Out‑of‑Bounds Read) and CWE-170 (Improper Null Termination).

Affected Systems

Apache Software Foundation’s Apache HTTP Server is affected through version 2.4.66. Users are advised to upgrade to version 2.4.67 or later, where the null‑termination check has been restored.

Risk and Exploitability

This vulnerability is accessible remotely via the AJP protocol; based on the description, it is inferred that an attacker can send a specially crafted request to trigger the over‑read. The CVSS score is 5.3, EPSS is not available, and the issue is not listed in CISA’s KEV catalog. While the probability of exploitation is unknown, the remote nature of the attack, coupled with the potential for data leakage or service disruption, warrants prompt action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.67 or later to apply the fix for the missing null‑termination check in mod_proxy_ajp.
  • If mod_proxy_ajp is not required, disable the module to eliminate the vulnerable code path.
  • Restrict the AJP port to trusted networks only, and consider wrapping it in a firewall or VPN to reduce exposure to external attackers.

Generated by OpenCVE AI on May 4, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4571-1 apache2 security update
Debian DSA Debian DSA DSA-6248-1 apache2 security update
Ubuntu USN Ubuntu USN USN-8239-1 Apache HTTP Server vulnerabilities
Ubuntu USN Ubuntu USN USN-8571-1 Apache HTTP Server vulnerabilities
History
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Title Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Weaknesses CWE-125
CWE-170
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
May 4, 2026, 5:32 PM
Reserved
Mar 25, 2026, 1:39 PM

View source JSON

Updated
May 4, 2026, 5:32 PM

JSON

Status
Analyzed
Published
May 4, 2026, 2:16 PM
Modified
Oct 26, 2026, 7:10 PM

View source JSON

Severity
Moderate
Public date
May 4, 2026, 12:54 PM

View source Bugzilla JSON

Updated
May 4, 2026, 4:00 PM

JSON