CVE-2026-56154

⛔ critical

Summary

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS Score

9.8

Critical

EPSS Score

0.6

Exploit Probability

Published Date

2026-10-01

First Seen: 2026-10-04

📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.6% of all 365,891 vulnerabilities in our database.

#34,455

Top 10% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Oct 1, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Nebula Security (@nebusecurity)

SSVC data provided by CISA

Last Modified 2026-10-05

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-416

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
apache	http_server	Affected	> 2.4.0 < 2.4.69

🔗 References 2

https://httpd.apache.org/security/vulnerabilities_24...

Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/10/0...

Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42356	ℹ️ low	3.7	0.5	Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI pr...	2026-10-01
CVE-2026-42528	🔶 medium	4.3	0.4	A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebD...	2026-10-01
CVE-2026-46729	⚠️ high	7.5	0.5	NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affe...	2026-10-01
CVE-2026-47360	⚠️ high	7.5	0.4	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie modu...	2026-10-01
CVE-2026-48005	⚠️ high	7.5	0.6	Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all p...	2026-10-01
CVE-2026-56153	⚠️ high	7.5	0.5	Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: fr...	2026-10-01

These CVEs affect the same products