PT-2026-36801 · Apache+3 · Apache Http Server+3

Elhanan Haenel · Published 2025-12-10 · Updated 2026-06-01 · CVE-2026-33857

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.67

Description An out-of-bounds read issue exists in the mod proxy ajp module of Apache HTTP Server, specifically within AJP getter functions. This flaw allows a remote attacker to read memory outside the intended range, which could lead to the disclosure of sensitive information.

Recommendations Upgrade to version 2.4.67.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2026:21391

ALSA-2026:21433

ALSA-2026:22140

BDU:2026-06352

BIT-APACHE-2026-33857

CVE-2026-33857

OESA-2026-2320

OESA-2026-2398

OESA-2026-2400

OESA-2026-2401

OESA-2026-2402

OPENSUSE-SU-2026:10785-1

USN-8239-1

Affected Products

Apache Http Server

Linuxmint

Rocky Linux

Ubuntu

References · 91

• https://osv.dev/vulnerability/USN-8239-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:22140 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-33857 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2400 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33006 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2320 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2402 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:21433 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33857 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2398 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28780 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23918 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33007 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:22140 · Vendor Advisory