Apache HTTP Server mod_proxy_ajp heap buffer overflow (CVE-2026-28780)

Summary

A malicious AJP backend may cause heap memory corruption.

Vulnerability ID	Vulnerability Overview
CVE-2026-28780	A crafted response from an AJP backend can make mod_proxy_ajp write four attacker-controlled bytes past a heap buffer. Exploitation requires the proxy to communicate with a malicious or compromised backend.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices