BIT-apache-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Q: Which deployments are affected?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_rewrite uses lookahead expressions of the form %{LA-U:HTTP:...}.

Q: What access does an attacker need to exploit this issue?

The supplied vector indicates exploitation can be performed remotely with low attack complexity, without privileges or user interaction. The specific request conditions needed to reach a vulnerable lookahead rule are not provided.

Q: What is the potential impact?

The vulnerability is rated critical with a 9.8 score and has high impact on confidentiality, integrity, and availability.

Published Oct 1, 2026

Updated

Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead (%{LA-U:HTTP:...})

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Event History

Oct 1, 2026

CVE Published

via OSV·04:03 PM

Data Sourced

via OSV·04:03 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_rewrite uses lookahead expressions of the form %{LA-U:HTTP:...}.

What access does an attacker need to exploit this issue?

The supplied vector indicates exploitation can be performed remotely with low attack complexity, without privileges or user interaction. The specific request conditions needed to reach a vulnerable lookahead rule are not provided.

What is the potential impact?

The vulnerability is rated critical with a 9.8 score and has high impact on confidentiality, integrity, and availability.

BIT-apache-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the potential impact?