AI analysis
CVE-2026-57941 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_http2 module, caused by re-entrancy on a shared session->bbtmp buffer that can lead to a wild write. It is triggered through the HTTP/2 handling path when that shared buffer is reused unsafely; the published data does not describe a specific request sequence or confirm remote code execution. An attacker who can exercise the flawed path may corrupt memory in the server process, with impact ranging from a crash to possible further memory corruption, depending on how the freed buffer is reused. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that has mod_http2 loaded is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.
What to do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as the Apache project publishes a fix, and confirm the running build is no longer in the 2.4.0–2.4.68 range. Until then, unload mod_http2 if HTTP/2 is not required (check with httpd -M or apachectl -M) and follow the Apache security advisory for this CVE. There is no public proof-of-concept and it is not listed in CISA KEV, but treat internet-facing servers that load mod_http2 as priority.
Affected
| Apache Software Foundation Apache HTTP Server | 2.4.0 through 2.4.68 |
Estimated exposure
massmillions of internet-facing Apache httpd installs in range; subset with mod_http2 loaded still likely in the millions (order-of-magnitude estimate) — Apache HTTP Server is one of the most widely deployed web servers; public web surveys and internet scans consistently show millions of exposed httpd instances, and the vulnerable range covers the entire 2.4 line through 2.4.68, though only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.