CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 2.4.69-1
2. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.7-1ubuntu4.22+esm16
3. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.18-2ubuntu3.17+esm21
4. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.29-1ubuntu4.27+esm12
5. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.41-4ubuntu3.23+esm8
6. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.52-1ubuntu4.24
7. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.58-1ubuntu8.16
8. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.68-1ubuntu6.1
9. Upgrade

   Upgrade ubuntu/apache2 to a version that resolves this vulnerability.

   Fixed in 2.4.66-2ubuntu2.5
10. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.71-1~deb12u1
11. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.69-1~deb13u1
12. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.69-1
13. Upgrade

    Upgrade debian/apache2 to a version that resolves this vulnerability.

    Fixed in 2.4.71-1~deb12u1Fixed in 2.4.71-1~deb13u1Fixed in 2.4.69-1Fixed in 2.4.71-1

Event History

Parent advisories

This vulnerability appears in the following advisories.

• DSA-6569

Peer vulnerabilities

Found alongside the following vulnerabilities.

• DLA-4902-1