Denial of service in Apache HTTP Server 2.4.0 through 2.4.68 arises from a use-after-free in the mod_rewrite module that is reachable only when a RewriteRule or RewriteCond uses the lookahead variables %{LA-U:...} or %{LA-F:...}, which exercise an internal subrequest code path. An unauthenticated remote attacker who can reach a server configured that way can trigger the memory error and crash request-handling processes, degrading or halting service; the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is confined to availability and the high attack complexity combined with the non-default configuration prerequisite substantially limits real-world exploitability. No CVSS score or vector has been published by NVD or the vendor, there is no EPSS probability and no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Improper privilege management in Apache HTTP Server's mod_ssl (versions 2.4.0 through 2.4.68) causes SSLRequire access-control directives that use file-related expressions to be evaluated in a way that can grant or deny access contrary to the server operator's intent, giving a remote attacker a possible means to reach content that the SSLRequire check was meant to protect or, conversely, to disrupt intended authorization. The flaw is not reachable in a default configuration: exploitation requires mod_ssl to be loaded and the operator to have configured access control specifically through the SSLRequire directive using file-related expressions, a non-default, operator-chosen configuration, which is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (high attack complexity, low confidentiality and integrity impact, no availability impact); authentication requirements for the attacker are not confirmed from available data. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided.