AI analysis
A use-after-free flaw (CWE-416) in mod_auth_digest of Apache HTTP Server before 2.4.69 allows an unauthenticated remote client to corrupt authentication state. It is triggered by concurrent Digest authentication requests only when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. The documented impact is authentication-state corruption and denial of service; code execution is not described. Any platform running a vulnerable build with that Digest configuration is affected. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation is not known.
What to do: Upgrade Apache HTTP Server to 2.4.69. Until then, do not enable AuthDigestNcCheck and do not set AuthDigestNonceLifetime to 0; if Digest authentication is not required, unload mod_auth_digest. Check access logs for bursts of concurrent Digest authentication requests against affected hosts.
Affected
| Apache Software Foundation Apache HTTP Server | before 2.4.69 (all platforms) |
Estimated exposure
moderatethousands to low tens of thousands of servers using the vulnerable Digest settings — Apache HTTP Server is widely deployed on millions of sites, but the flaw is only triggerable when mod_auth_digest is used with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0, which is an uncommon configuration.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.