Apache HTTP Server CVE-2026-56154

Exploitation requires the target Apache HTTP Server to have mod_rewrite loaded AND a RewriteRule/RewriteCond configuration that uses the lookahead variables %{LA-U:...} (or %{LA-F:...}), which trigger the internal subrequest code path containing the use-after-free; servers without mod_rewrite, or with rewrite rules that do not use lookahead, are not affected. This non-default configuration dependency is the primary limiting factor on real-world exploitability. Affected versions are 2.4.0 through 2.4.68; reliably triggering the use-after-free may also depend on subrequest timing, and the documented impact is denial of service rather than confirmed code execution.

No CVSS score or vector is provided by NVD or the vendor, and there is no EPSS probability, no CISA KEV listing, and no SSVC decision data, so quantitative exploitation signals are entirely absent - this assessment is driven by the description and CWE alone. The flaw is a use-after-free (CWE-416) in Apache HTTP Server's mod_rewrite, triggered specifically when the lookahead directive (%{LA-U:HTTP:...}) is used, which performs an internal subrequest; the vendor tag set ('Denial Of Service', 'Memory Corruption') indicates the realistic impact is a worker crash / denial of service rather than confirmed code execution. Although Apache httpd is ubiquitous, exploitability is gated by a non-default configuration (mod_rewrite rules that invoke LA-U lookahead), which substantially narrows the exploitable population below the raw install base. Net: treat as a moderate, config-dependent availability risk - patch during normal cycles on affected 2.4.0-2.4.68 servers that actually use rewrite lookahead, but it is not a drop-everything emergency absent EPSS/KEV/POC evidence. Note explicitly: no CVSS vector exists in the input, so attack vector, complexity, and privilege requirements below are my independent assessment and should be verified against the Apache advisory.

An attacker who can reach a vulnerable Apache HTTP Server (2.4.0-2.4.68) whose configuration uses mod_rewrite with a %{LA-U:HTTP:...} lookahead sends crafted HTTP requests that drive the internal subrequest handling into a use-after-free, corrupting freed memory and crashing the worker process to cause denial of service. No public exploit is identified at time of analysis, and reliable triggering of the use-after-free may require specific timing against the subrequest lifecycle.