A heap over‑read in Apache HTTP Server’s mod_proxy_ajp component, specifically the ajp_parse_data() function, allows an attacker to read uninitialized memory. This can lead to disclosure of sensitive data contained in the process’s address space and is identified as CWE‑126. The vulnerability is limited to the AJP protocol handling and does not immediately impact authentication or integrity.

Apache Software Foundation’s Apache HTTP Server, versions up through and including 2.4.66. No other vendor or product is affected according to the CNA data.

The likely attack vector involves sending a crafted AJP request to an Apache instance that has mod_proxy_ajp enabled. Based on the description, it is inferred that an attacker who can reach the AJP endpoint may exploit the buffer over‑read to read uninitialized memory. With a CVSS score of 7.5, this is a high‑severity vulnerability when AJP is exposed over an untrusted network. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so a definitive threat likelihood cannot be quantified, but the impact remains significant if the AJP endpoint is reachable.