CVE-2026-56154

A use-after-free flaw was found in the mod_rewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %{LA-U:HTTP:...}. A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration, potentially causing a denial of service or arbitrary code execution.

Red Hat initially assesses this issue as Important due to the potential for remote denial of service or code execution in affected mod_rewrite configurations. Exploitation requires URL lookahead expressions that reference HTTP request headers, such as %{LA-U:HTTP:...}. Product-specific impact and exploitation conditions remain under review with Engineering.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Review the effective Apache HTTP Server configuration, including virtual host configurations and .htaccess files, for affected HTTP-header lookahead expressions such as %{LA-U:HTTP:...}. Remove or replace these expressions where application requirements permit. Alternatively, disable mod_rewrite if the application does not require it. These changes may affect URL rewriting and application routing. Validate the configuration and reload or restart the service as appropriate. Apply a vendor-supported security update containing the fix when available.