Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-56154: Apache HTTP Server mod_rewrite can be exploited

CVE-2026-56154 · published 9 days ago

Summary

The Apache web server versions 2.4.0 through 2.4.68 have a flaw in the mod_rewrite component that can be triggered by specially crafted requests. An attacker could cause the server to stop working or potentially gain control of it. Apply the latest Apache updates or patches that fix this issue as soon as possible.

What to do

Update alpine apache2 to version 2.4.69-r0.
Update debian apache2 to version 2.4.69-1.
Update bellsoft apache2 to version 2.4.69-r0.
Update apache to version 2.4.69.
Update apache2 to version 2.4.69-r0.
Update apache http_server to version 2.4.69 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	apache software foundation	apache http server	<= 2.4.68
Debian:12	debian	apache2	All versions
Ubuntu:Pro:14.04:LTS	canonical	apache2	All versions
Alpine:v3.21	alpine	apache2	< 2.4.69-r0 Fix: upgrade to 2.4.69-r0
Debian:14	debian	apache2	< 2.4.69-1 Fix: upgrade to 2.4.69-1
Alpaquita:23	bellsoft	apache2	>= 2.4.54-r2, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
Alpaquita:25	bellsoft	apache2	>= 2.4.63-r0, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
Alpaquita:stream	bellsoft	apache2	>= 2.4.56-r0, < 2.4.69-r0 Fix: upgrade to 2.4.69-r0
–	apache	http_server	>= 2.4.0, < 2.4.69 `cpe:2.3:a:apache:http_server::::::::`
Bitnami	–	apache	>= 2.4.0, < 2.4.69 Fix: upgrade to 2.4.69
Alpine:v3.21	–	apache2	< 2.4.69-r0 Fix: upgrade to 2.4.69-r0

Original advisory text

BELL-CVE-2026-56154

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...})

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

References

https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-56154 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/01/17 Vendor Advisory
https://ubuntu.com/security/CVE-2026-56154 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-56154 Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-56154 Third Party Advisory
https://security.alpinelinux.org/vuln/CVE-2026-56154 Vendor Advisory
https://docs.bell-sw.com/security/cves/CVE-2026-56154 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56154 URL

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published1 Oct 2026

Updated9 Oct 2026

First seen1 Oct 2026

Sources

CVE-2026-56154 · NVD

CVE-2026-56154 · MITRE

DEBIAN-CVE-2026-56154 · OSV

UBUNTU-CVE-2026-56154 · OSV

ALPINE-CVE-2026-56154 · OSV

BELL-CVE-2026-56154 · OSV

BIT-apache-2026-56154 · OSV

Track software like this

Free during beta