UBUNTU-CVE-2026-57941: Use After Free

Q: Which Apache HTTP Server installations are affected?

Apache HTTP Server versions from 2.4.0 through 2.4.68 are affected when mod_http2 is in use. The provided data identifies Ubuntu's apache2 package as the affected software.

Q: Can this be exploited remotely without authentication or user interaction?

Yes. The CVSS vector specifies network access, low attack complexity, no privileges required, and no user interaction, indicating an unauthenticated remote attacker can attempt exploitation.

Q: What is the potential impact of successful exploitation?

The severity vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation could therefore compromise data confidentiality, alter data or server behavior, and disrupt service availability.

Published Oct 1, 2026

Updated

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected Software

6 affected componentsFixes available

ubuntu/apache2<2.4.29-1ubuntu4.27+esm12

2.4.29-1ubuntu4.27+esm12

ubuntu/apache2<2.4.41-4ubuntu3.23+esm8

2.4.41-4ubuntu3.23+esm8

ubuntu/apache2<2.4.52-1ubuntu4.24

2.4.52-1ubuntu4.24

ubuntu/apache2<2.4.58-1ubuntu8.16

2.4.58-1ubuntu8.16

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.5

2.4.66-2ubuntu2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.29-1ubuntu4.27+esm12
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm8
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.24
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.16
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.5

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Apache HTTP Server installations are affected?

Apache HTTP Server versions from 2.4.0 through 2.4.68 are affected when mod_http2 is in use. The provided data identifies Ubuntu's apache2 package as the affected software.

Can this be exploited remotely without authentication or user interaction?

Yes. The CVSS vector specifies network access, low attack complexity, no privileges required, and no user interaction, indicating an unauthenticated remote attacker can attempt exploitation.

What is the potential impact of successful exploitation?

The severity vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation could therefore compromise data confidentiality, alter data or server behavior, and disrupt service availability.

UBUNTU-CVE-2026-57941: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Apache HTTP Server installations are affected?

Can this be exploited remotely without authentication or user interaction?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Apache HTTP Server installations are affected?

Can this be exploited remotely without authentication or user interaction?

What is the potential impact of successful exploitation?