CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Published Oct 1, 2026
·Updated
Apache HTTP Server: modhttp2 use-after-free / wild write via shared session->bbtmp re-entrancy
Other sources
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session->bbtmp re-entrancy
— Launchpad
Affected Software
4 affected componentsFixes available
Apache HTTP Server>=2.4.0<=2.4.68
Apache HTTP Server>=2.4.0<2.4.69
Microsoft azl3 httpd 2.4.68-1<2.4.69-1
2.4.69-1
debian/apache2<=2.4.68-1~deb12u1, <=2.4.67-1~deb12u3, <=2.4.68-1~deb13u1, <=2.4.67-1~deb13u3
2.4.69-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.69-1
Event History
Oct 1, 2026
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeaknessAffected Software
Oct 7, 2026
Data Sourced
via Microsoft·08:31 AM
DescriptionSeverityWeaknessAffected Software
Oct 12, 2026
Data Sourced
via Ubuntu·07:19 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·07:20 AM
DescriptionAffected Software
Data Sourced
via Launchpad·07:20 AM
Description
Frequently Asked Questions
1
Which deployments are within the affected version range?
Apache HTTP Server versions from 2.4.0 through 2.4.68 are affected according to the available information.
2
Is exploitation tied to a particular Apache module?
The issue is in mod_http2, so deployments using that module are the relevant exposure area.