CVE-2026-57941

Analyzed Analyzed - Analysis Complete

Use After Free in Apache HTTP Server mod_http2

Publication date: 2026-10-01

Last updated on: 2026-10-05

Assigner: Apache Software Foundation

Description

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-57941

EUVD

EUVD-2026-90896

Affected Vendors & Products

Vendor	Product	Version / Range
apache	http_server	From 2.4.0 (inc) to 2.4.69 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Use After Free vulnerability in Apache HTTP Server's mod_http2 module. It occurs due to shared session->bbtmp re-entrancy, where memory is freed but later accessed again, potentially leading to crashes or arbitrary code execution.

Detection Guidance

This vulnerability affects Apache HTTP Server versions 2.4.0 through 2.4.68. To detect it, check your Apache version using 'httpd -v' or 'apache2 -v'. If your version falls within this range, the system is potentially vulnerable. No specific commands are provided for detection beyond version verification.

Impact Analysis

This vulnerability could cause Apache HTTP Server to crash or allow attackers to execute arbitrary code on affected systems. It may lead to denial of service or unauthorized access if exploited.

Compliance Impact

This vulnerability, a Use After Free issue in Apache HTTP Server's mod_http2, could potentially lead to unauthorized access or data corruption due to its high severity (CVSS 9.8). Such risks may impact compliance with standards like GDPR or HIPAA, which require protection against data breaches and unauthorized access. However, specific compliance impacts depend on system configuration and data handling practices.

Mitigation Strategies

Upgrade Apache HTTP Server to a version beyond 2.4.68 to address the Use After Free vulnerability in mod_http2.

Hi! I’m here to help you understand CVE-2026-57941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70