BIT-apache-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Q: Which Apache HTTP Server versions are affected?

Apache HTTP Server versions from 2.4.0 through 2.4.68 are affected.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the potential impact if this is exploited?

The vulnerability is rated critical with high impact to confidentiality, integrity, and availability. It is classified as a use-after-free issue in mod_http2.

Published Oct 1, 2026

Updated

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session->bbtmp re-entrancy

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Event History

Oct 1, 2026

CVE Published

via OSV·04:06 PM

Data Sourced

via OSV·04:06 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Apache HTTP Server versions are affected?

Apache HTTP Server versions from 2.4.0 through 2.4.68 are affected.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the potential impact if this is exploited?

The vulnerability is rated critical with high impact to confidentiality, integrity, and availability. It is classified as a use-after-free issue in mod_http2.

BIT-apache-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Affected Software

Event History

Frequently Asked Questions

Which Apache HTTP Server versions are affected?

Does exploitation require authentication or user interaction?

What is the potential impact if this is exploited?

Company

Resources

Contact

Frequently Asked Questions

Which Apache HTTP Server versions are affected?

Does exploitation require authentication or user interaction?

What is the potential impact if this is exploited?