CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

CVE-2026-56154 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_rewrite when rewrite rules use the lookahead syntax %{LA-U:HTTP:...}. A request that causes that lookahead to run can free memory and then use it again, which can crash a server worker and, depending on memory layout, may allow further memory corruption. The issue affects Apache HTTP Server from 2.4.0 through 2.4.68 on any host whose configuration uses that lookahead; CVSS has not been scored. It is not listed in CISA KEV, and no public proof-of-concept is known, so exploitation is none known at this time.

Do: Upgrade Apache HTTP Server to a release newer than 2.4.68 as soon as Apache publishes the fix, and confirm the running version afterward. Until then, remove or avoid mod_rewrite rules that use the %{LA-U:HTTP:...} lookahead if that feature is not required, and watch Apache security advisories. No public proof-of-concept or known in-the-wild exploitation is reported, but treat internet-facing 2.4.0–2.4.68 servers as priority to patch.