CVE-2026-57941 | Vulnetix

CVE-2026-57941 PUBLISHED CVSS 9.8 CRITICAL

Reported by apache · Published October 1, 2026

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
httpd	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
httpd-tools	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
httpd-manual	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
mod_ldap	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
httpd-filesystem	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
apache	Bitnami	2.4.69
mod_session	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
mod_http2	Amazon Linux	1:2.4.69-1.amzn2023.0.2, 1:2.4.69-1.amzn2.0.3
mod_proxy_html	Amazon Linux	1:2.4.69-1.amzn2023.0.2, 1:2.4.69-1.amzn2.0.3
httpd-devel	Amazon Linux	2.4.69-1.amzn2023.0.2, 2.4.69-1.amzn2.0.3
mod_ssl	Amazon Linux	1:2.4.69-1.amzn2023.0.2, 1:2.4.69-1.amzn2.0.3
mod_md	Amazon Linux	2.4.69-1.amzn2.0.3

5 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
Apache Software Foundation	Apache HTTP Server	2.4.0
amazon:2023	httpd	0
amazon:2023	httpd-tools	0
amazon:2023	httpd-manual	0
amazon:2023	mod_ldap	0
amazon:2	httpd-filesystem	0
amazon:2	mod_ldap	0
amazon:2023	mod_session	0
amazon:2023	mod_http2	0
amazon:2	mod_proxy_html	0
amazon:2	httpd-devel	0
amazon:2	mod_ssl	0
amazon:2	httpd-tools	0
amazon:2	mod_md	0
amazon:2023	httpd-devel	0
amazon:2023	mod_proxy_html	0
amazon:2023	httpd-filesystem	0
amazon:2	httpd	0
Apache Software Foundation	Apache HTTP Server	2.4.0
amazon:2	mod_http2	0

…and 6 more

Timeline

Oct 1, 2026 Coalition ESS Score
Oct 1, 2026 CVE Published
Oct 2, 2026 EPSS Score (12 in total, the first dated here)
Oct 5, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-57941
vulnetix vdb fixes CVE-2026-57941

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-57941/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

vendor-advisory
http://www.openwall.com/lists/oss-security/2026/10/01/19 url

Look up in the Resolve Platform →