onyx --cves cve-2026-28780
CVE-2026-28780
- score
- <0.1
- cvss
- 9.8
- epss
- 1.6%
- published
- 2026-05-05
- kev added
- —
- first seen
Apache HTTP Server <= 2.4.66 contains a heap-based buffer overflow caused by mod_proxy_ajp processing malicious AJP messages, letting remote attackers cause memory corruption, exploit requires connection to a malicious AJP server.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 17
- https://bugzilla.redhat.com/show_bug.cgi?id=2466913
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28780.json
- https://access.redhat.com/errata/RHSA-2026:66323
- https://access.redhat.com/errata/RHSA-2026:27200
- https://access.redhat.com/errata/RHSA-2026:36373
- https://access.redhat.com/errata/RHSA-2026:36831
- https://access.redhat.com/errata/RHSA-2026:47046
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://access.redhat.com/errata/RHSA-2026:27201
- https://access.redhat.com/security/cve/CVE-2026-28780
- https://access.redhat.com/errata/RHSA-2026:36846
- https://access.redhat.com/errata/RHSA-2026:62165
- https://access.redhat.com/errata/RHSA-2026:67152
- http://www.openwall.com/lists/oss-security/2026/05/05/9
- https://access.redhat.com/errata/RHSA-2026:21391
- https://access.redhat.com/errata/RHSA-2026:21433
- https://access.redhat.com/errata/RHSA-2026:22140