Advisoriesby IbisApache Software FoundationCVE-2026-57941
Apache HTTP Server: use after free
Critical9.8CVE-2026-57941 · Published Oct 1, 2026 · updated Oct 5, 2026
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Apache HTTP Server Product | >= 2.4.0, <= 2.4.68 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-416
More Apache Software Foundation advisories
All Apache Software Foundation| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 1 | Apache HTTP Server: integer overflow | High8.8 | No fix yet |
| Oct 1 | Apache HTTP Server: use after free | High7.3 | No fix yet |
| Oct 1 | Path equivalence: '/./' | Medium5.3 | No fix yet |
| Oct 1 | Apache HTTP Server: request smuggling | High7.5 | No fix yet |
| Oct 1 | Apache HTTP Server: authentication bypass | High8.1 | No fix yet |
| Oct 1 | Apache HTTP Server: exposed files | Medium5.3 | No fix yet |