AI analysis
CVE-2026-56154 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_rewrite when rewrite rules use the lookahead syntax %{LA-U:HTTP:...}. A request that causes that lookahead to run can free memory and then use it again, which can crash a server worker and, depending on memory layout, may allow further memory corruption. The issue affects Apache HTTP Server from 2.4.0 through 2.4.68 on any host whose configuration uses that lookahead; CVSS has not been scored. It is not listed in CISA KEV, and no public proof-of-concept is known, so exploitation is none known at this time.
What to do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as Apache publishes the fix, and confirm the running version afterward. Until then, remove or avoid mod_rewrite rules that use the %{LA-U:HTTP:...} lookahead if that feature is not required, and watch Apache security advisories. No public proof-of-concept or known in-the-wild exploitation is reported, but treat internet-facing 2.4.0–2.4.68 servers as priority to patch.
Affected
| Apache Software Foundation Apache HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
massmillions of Apache HTTP Server 2.4 installs (order of 1M+ sites); directly triggerable only where mod_rewrite uses %{LA-U:HTTP:...} — Apache HTTP Server is one of the most widely deployed web servers; public market-share surveys and internet scans have long indicated millions of sites and well over 100,000 exposed hosts running httpd, and 2.4.0–2.4.68 covers the 2.4 line…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.