CVE-2026-57941, CoreCVE

Back Back to CVE browser

CRITICAL

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Published Oct 1, 2026

9.8

CRITICAL

CVSS 3.1

Description

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Affected products

Vendor Apache Software Foundation Product Apache HTTP Server Default
unaffected
- Version
  2.4.0
  Status
  affected
  Constraints
  <=2.4.68

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache HTTP Server

unaffected

Version	Status	Constraints
2.4.0	affected	<=2.4.68

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-416

Use After Free

References (1)

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory

Link	Providers	Tags
https://httpd.apache.org/security/vulnerabilities_24.html		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published Oct 1, 2026

Updated Oct 1, 2026

Reserved Jun 26, 2026

Link CVE-2026-57941

CISA Vulnrichment

Updated Oct 1, 2026

NVD

Status Received

Modified Oct 1, 2026

Link CVE-2026-57941

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-57941