Skip to main content

Apache HTTP Server EUVDEUVD-2026-90896

| CVE-2026-57941 CRITICAL
Use After Free (CWE-416)
2026-10-01 apache GHSA-w59m-qjff-crxx
Denial Of Service Apache Use After Free Memory Corruption Suse Apache Http Server Apache Software Foundation
9.8
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach HTTP/2-enabled Apache endpoint
  2. Delivery
    Send crafted concurrent/streamed h2 requests
  3. Exploit
    Trigger re-entrant access to session->bbtmp
  4. Execution
    Use-after-free on freed brigade
  5. Impact
    Worker crash / denial of service

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitable only when mod_http2 is loaded and HTTP/2 is actively enabled (h2 and/or h2c listed in the Protocols directive) on Apache HTTP Server 2.4.0-2.4.68; the bug lives in the HTTP/2 session handling of the shared bbtmp brigade. The required trigger is re-entrant access to that shared buffer, implying the attacker must drive specific concurrent/streamed HTTP/2 request patterns rather than a single trivial request, which raises attack complexity. LIMITING FACTORS: servers without HTTP/2 enabled are not affected; authentication requirements cannot be confirmed because no CVSS vector was supplied; realistic impact appears limited to availability (crash) per the Denial Of Service tag.
Impact

This is a CWE-416 Use After Free in Apache HTTP Server's mod_http2, triggered via re-entrant access to the shared session->bbtmp brigade. No CVSS, EPSS, KEV, or POC data was provided, so the raw-signal picture is thin and no field can be treated as confirmed exploitation. Based on the description and the 'Denial Of Service'/'Memory Corruption' tags, the realistic impact is a server crash/worker termination rather than confirmed code execution; UAF conditions can theoretically escalate to RCE but nothing in the input supports that, and the 're-entrancy' framing implies a specific timing/state condition that raises attack complexity. The mitigating reality is that exploitation requires HTTP/2 to be enabled (mod_http2 loaded with h2/h2c in Protocols), which is NOT universal across Apache deployments, so the practical exposure is narrower than the product's ubiquity suggests. Net: treat as a medium-priority availability patch for any Internet-facing Apache running HTTP/2 - real but not an emergency absent evidence of active exploitation. KEY MISSING DATA: no CVSS vector means authentication and attack-vector qualifiers cannot be confirmed from scoring; no EPSS/KEV/POC means exploitation likelihood is unquantified.
Exploit ScenarioDerived

A remote attacker sends crafted HTTP/2 requests to an Apache server (2.4.0-2.4.68) with mod_http2 enabled, inducing re-entrant use of the shared session->bbtmp buffer so a freed brigade is accessed again. The resulting use-after-free crashes the worker/process, causing denial of service; no public exploit code was identified at time of analysis. Exploitation is limited to deployments that have HTTP/2 actively enabled.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Use-after-free in Apache HTTP Server's mod_http2 module (versions 2.4.0 through 2.4.68) allows unauthenticated remote attackers to corrupt memory and crash server worker processes by driving re-entrant access to a shared per-session buffer. The flaw only manifests when mod_http2 is loaded and HTTP/2 is actually enabled (h2 and/or h2c in the Protocols directive), and the trigger requires specific concurrent/streamed HTTP/2 request patterns, so the assessed vector is network-reachable but high complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact limited to availability. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied.

RemediationAI

Apply the Apache HTTP Server fix for this issue by upgrading to the first 2.4.x release after 2.4.68 as published in the vendor advisory at https://httpd.apache.org/security/vulnerabilities_24.html, and confirm the exact patched version there since the supplied data does not state a fix version outright. Until that upgrade can be deployed, the most effective compensating control is to stop exercising the vulnerable code path: remove h2 and h2c from the Protocols directive (e.g. set Protocols http/1.1) or unload mod_http2 entirely, which eliminates exposure but forfeits HTTP/2 multiplexing, header compression and stream prioritization and may increase latency for clients that negotiated HTTP/2. A partial mitigation is to cap concurrent HTTP/2 activity with directives such as H2MaxSessionStreams, H2StreamMaxMemSize and aggressive idle/keep-alive timeouts to reduce the window for re-entrant session handling; this lowers likelihood but is not a complete fix because the defect is a logic-level use-after-free, not a resource-exhaustion issue. If a reverse proxy or WAF terminates HTTP/2 in front of the origin, forcing HTTP/1.1 on the backend connection provides equivalent protection with the trade-off of losing end-to-end HTTP/2 semantics. No vendor-released patch beyond the affected 2.4.0-2.4.68 range is confirmed from the provided data, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Affected VersionsENISA

Apache HTTP Server 2.4.0 ≤2.4.68

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache HTTP Server's mod_http2 implements the HTTP/2 protocol (RFC 7540/9113) including multiplexed streams, HPACK header handling and flow control, and it maintains per-connection session state. The bug is class CWE-416 (Use After Free) in the shared session->bbtmp brigade, a temporary bucket-brigade buffer used while assembling and flushing HTTP/2 frame output. Because multiple logical HTTP/2 streams share a single session context, re-entrancy into that shared buffer (for example, a nested or interleaved code path triggering a flush or cleanup while another path still holds a reference) can free the brigade while a pointer to it is still live, producing a dangling reference that is later dereferenced. This is a memory-safety defect intrinsic to concurrent HTTP/2 session handling rather than an input-validation issue; it requires the HTTP/2 protocol layer to be active (h2/h2c), which is why deployments serving only HTTP/1.1 are outside the affected path. The supplied CPE (cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:*) is unversioned, so the authoritative version scope is the vendor-list range 2.4.0 through 2.4.68. The use-after-free primitive is a memory-corruption class that in principle could be leveraged beyond a crash, but the independent assessment constrains confidentiality and integrity impact to none and rates availability impact high, consistent with the Denial Of Service and Memory Corruption tags.

Know when Apache Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 9.8 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.9 MEDIUM

Remotely reachable over HTTP/2 with no auth (AV:N/PR:N/UI:N); re-entrancy race makes reliable triggering hard (AC:H); impact is a crash/DoS so A:H with no C/I.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Articles & Coverage 1

News Critical Use-After-Free in Apache HTTP Server mod_http2 - CVE-2026-57941 Oct 02, 2026

Threat Intelligence Overview

EPSS Score
0.4%
Top 64% exploitable
Prevalence
Ubiquitous
Apache HTTP Server is among the most widely deployed web servers globally
Threat Intel
1
1 sources
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment NEWS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
High
Technical Impact
Total

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-93546 HIGH
8.8 Oct 01

An integer overflow in the mod_dav_fs module of Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client

CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-63292 HIGH
7.5 Oct 01

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthen
CVE-2026-59685 HIGH
7.5 Oct 01

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processe
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-57941 ADVISORY https://seclists.org/oss-sec/2026/q4/18 ADVISORY https://vuldb.com/vuln/412726 REF http://www.openwall.com/lists/oss-security/2026/10/01/19

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy