Apache HTTP Server mod_http2: Use-after-free vulnerability

Summary

A use-after-free flaw in the mod_http2 module of Apache HTTP Server allows a remote attacker to crash httpd worker processes, which causes a denial of service. The flaw is caused by re-entrant use of a shared session buffer (session->bbtmp). The CVSS score is 9.8 (Critical) in NVD, but Apache rates it as moderate. Only servers with mod_http2 loaded are affected, and no login or user interaction is required.

Affected

• Apache HTTP Server 2.4.0 through 2.4.68 according to the CVE record and the oss-security post
• The Apache advisory page lists 2.4.17 through 2.4.68 for this CVE; the lower bound is not fully confirmed
• Only installations with mod_http2 enabled are affected

Fixed in

• Apache HTTP Server 2.4.69 (released 2026-10-01, upstream commit r1938665)
• Distribution packages: check the vendor advisory for backported fixed versions

Workaround

• Disable mod_http2 until a fixed version is installed (check loaded modules with httpd -M)
• Clients then fall back to HTTP/1.1; check the operational impact first

Exploitation

• CISA SSVC lists exploitation as none and automatable as yes
• No public exploitation or proof of concept has been reported at the time of writing
• The demonstrated effect is a worker crash (denial of service); code execution is not confirmed

Our recommendation

• Inventory all httpd instances and check whether mod_http2 is loaded (httpd -M), especially internet-facing servers and reverse proxies
• Update to Apache HTTP Server 2.4.69 or the distribution's fixed package
• If patching must wait, disable mod_http2 on exposed servers
• Monitor for worker crashes and for new public exploit code
• Prioritise based on Apache's moderate rating and actual exposure, not only the 9.8 CVSS score

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache HTTP Server 2.4 vulnerabilities httpd.apache.org
• oss-security post CVE-2026-57941 www.openwall.com
• Red Hat CVE-2026-57941 access.redhat.com
• Debian Security Tracker CVE-2026-57941 security-tracker.debian.org
• Apache httpd 2.4.69 release notes overview top-secured.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:35.