CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack
Unauthenticated clients can corrupt Apache Digest authentication state via CVE-2026-73637 under specific settings.
Apache disclosed CVE-2026-73637, a use-after-free in mod_auth_digest affecting Apache HTTP Server 2.4.0 through 2.4.68 on all platforms, with an upgrade to 2.4.69 recommended. An unauthenticated remote client can corrupt authentication state by sending concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Apache rated the issue low. The disclosure does not say the flaw is being exploited.
44