CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

CVE-2026-57941 is a use-after-free (CWE-416) in Apache HTTP Server’s mod_http2 module, caused by re-entrancy on a shared session->bbtmp buffer that can lead to a wild write. It is triggered through the HTTP/2 handling path when that shared buffer is reused unsafely; the published data does not describe a specific request sequence or confirm remote code execution. An attacker who can exercise the flawed path may corrupt memory in the server process, with impact ranging from a crash to possible further memory corruption, depending on how the freed buffer is reused. Every Apache HTTP Server release from 2.4.0 through 2.4.68 that has mod_http2 loaded is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.