Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)

🗓️ 07 May 2026 08:11:33Reported by MicrosoftType

Apache mod_proxy_ajp has a heap over-read due to missing null termination in ajp_msg_get_string.

Reporter	Title	Published	Views	Family All 108
FreeBSD	www/apache24 -- Multiple vulnerabilities	4 May 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase [CVE-2026-24072, CVE-2026-28780, CVE-2026-34059, CVE-2026-33523, CVE-2026-41080, CVE-2026-33857, CVE-2026-34032]	22 May 202605:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities	11 May 202622:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	18 May 202615:31	–	ibm
ATTACKERKB	CVE-2026-34032	4 May 202612:54	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2026-1720)	26 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpd, --advisory ALAS2-2026-3314 (ALAS-2026-3314)	27 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : httpd (ALSA-2026:21391)	29 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : httpd (ALSA-2026:21433)	28 May 202600:00	–	nessus
Tenable Nessus	Apache 2.4.x < 2.4.67 Multiple Vulnerabilities	4 May 202600:00	–	nessus