Apache HTTP Server: Use-after-free in mod_rewrite via lookahead expressions
Summary
Apache HTTP Server versions 2.4.0 through 2.4.68 contain a use-after-free flaw in mod_rewrite when the configuration uses lookahead expressions such as %{LA-U:HTTP:...}. A remote attacker without authentication or user interaction may be able to trigger invalid memory access, which could cause a denial of service or potentially arbitrary code execution. The attack only applies where an affected rewrite configuration is in use. The NVD score is 9.8 (critical), while Apache rates the issue as low.
Affected
- Apache HTTP Server 2.4.0 through 2.4.68
- Only servers that use lookahead expressions such as %{LA-U:HTTP:...} in mod_rewrite rules (server config, virtual hosts or .htaccess files)
- Unknown for 2.2 and other branches; the vendor has not stated a fix there.
Fixed in
- Apache HTTP Server 2.4.69 (released 2026-10-01)
- Distribution packages: Unknown for exact build numbers; check your distribution's security tracker.
Workaround
- Review the effective configuration, including virtual hosts and .htaccess files, for lookahead expressions that reference HTTP headers.
- Remove or replace these expressions where application requirements permit, or disable mod_rewrite if the application does not need it.
- These changes may affect URL rewriting and application routing.
Exploitation
- CISA KEV: not listed according to one aggregator; verify directly in the CISA catalog.
- Public exploit code: none found; absence in searches is not proof.
- EPSS: about 0.56% (45th percentile) according to one aggregator; use as a rough signal only.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all Apache HTTP Server 2.4 instances, including containers and appliances, and compare versions with 2.4.69.
- Search configurations and .htaccess files for LA-U:HTTP: and other LA- lookahead usage; disable mod_rewrite where it is not needed.
- Update to 2.4.69 or your distribution's fixed build, and apply all other fixes in the same release, including CVE-2026-57941.
- Monitor the CISA KEV catalog and vendor advisories, as the severity assessment and exploitation signals may change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache HTTP Server 2.4 vulnerabilities httpd.apache.org
- oss-security mailing list: CVE-2026-56154 www.openwall.com
- Red Hat CVE-2026-56154 access.redhat.com
- Ubuntu CVE-2026-56154 notice (CIRCL) vulnerability.circl.lu
- OSV: DEBIAN-CVE-2026-56154 osv.dev
- CVE record JSON (CVE List V5) raw.githubusercontent.com
- Cyber-Defence CVE-2026-56154 www.cyber-defence.io
- TheHackerWire CVE-2026-56154 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:36.
Original description (NVD)
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.