Description

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-01T17:17:26.610Z",
  "pubdate": "2026-10-01T17:17:26.610Z",
  "executiveSummary": "A critical Use After Free (UAF) vulnerability has been identified within the Apache HTTP Server's mod_rewrite module. The flaw specifically resides in the handling of lookahead expressions, specifically the %{LA-U:HTTP:...} syntax, which is used to perform subrequests during URL rewriting processes. This vulnerability impacts Apache HTTP Server versions 2.4.0 through 2.4.68.\nThe vulnerability allows a remote, unauthenticated attacker to trigger a memory corruption condition by providing specially crafted requests that manipulate the rewrite engine's subrequest processing. Successful exploitation can lead to a crash of the web server process (Denial of Service), or potentially allow for arbitrary code execution if memory structures are manipulated effectively. Given that mod_rewrite is a widely utilized and core component of Apache configurations, the exposure is significant. Organizations running affected versions are at risk of service disruption and potential system compromise. The vulnerability does not require authentication, making it particularly dangerous for internet-facing servers that rely on complex rewrite rules utilizing lookahead directives.",
  "technicalDetails": "The vulnerability originates in the architectural handling of subrequests within the mod_rewrite module, specifically when the rewrite engine encounters the lookahead directive (%{LA-U:HTTP:...}). When processing these directives, mod_rewrite initiates an internal subrequest to fetch header values or other environment variables to evaluate against the rewrite condition. The flaw manifests due to an improper object lifecycle management during the transition between the primary request processing context and the subrequest context.\nSpecifically, the UAF occurs when the memory pointer representing the rewrite request context is freed prematurely while a subsequent phase of the lookahead processing still attempts to access that memory address. In the context of mod_rewrite's lookahead execution, the engine performs a lookup and, under specific sequence-of-events conditions, triggers an early cleanup or destruction of the internal request structure. If an attacker can ensure that a subrequest is initiated and then interrupted or redirected in such a way that the pointers are not updated, the engine retains a dangling pointer to the deallocated request structure.\nThe attack flow typically involves an attacker sending a maliciously crafted HTTP request containing headers or parameters that force the execution of a mod_rewrite rule utilizing the %{LA-U:HTTP:...} construct. By carefully orchestrating the input, the attacker causes the rewrite engine to create a reference to a memory block and subsequently trigger a branch of code that releases that memory prematurely. When the engine attempts to reference that memory again to finalize the lookahead value, it accesses a freed memory region. If the memory allocator has reused this freed block for different request data or internal structures, the attacker can influence the contents of the freed memory (heap grooming), potentially redirecting execution flow if the referenced memory is used for function pointers or control data.\nThe affected component is the mod_rewrite module in Apache HTTP Server versions 2.4.0 through 2.4.68. The vulnerability is network-exposed and does not require authentication, as the rewrite engine processes requests before traditional authentication handlers are invoked. The post-exploitation impact includes memory corruption which results in process instability (SIGSEGV) causing Denial of Service. In more advanced scenarios involving heap heap exploitation techniques, an attacker might leverage the UAF to overwrite object pointers, leading to arbitrary code execution within the context of the Apache worker process."
}