CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack
Unauthenticated clients can corrupt Apache Digest authentication state via CVE-2026-73637 under specific settings.
Apache disclosed CVE-2026-73637, a use-after-free in mod_auth_digest affecting Apache HTTP Server 2.4.0 through 2.4.68 on all platforms, with an upgrade to 2.4.69 recommended. An unauthenticated remote client can corrupt authentication state by sending concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Apache rated the issue low. The disclosure does not say the flaw is being exploited.
- CVE-2026-73637 is a use-after-free in mod_auth_digest.
- Versions 2.4.0 through 2.4.68 are affected; 2.4.69 is recommended.
- Unauthenticated clients can corrupt Digest authentication state under specific settings.
- Apache rated it low; active exploitation is not reported.
Vulnerabilities mentionedAll →
- CVE-2026-736377.3—Use-after-free in Apache HTTP Server mod_auth_digestpublished · Apache Software Foundation Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-73637 | Use-after-free in Apache HTTP Server mod_auth_digest A use-after-free flaw (CWE-416) in mod_auth_digest of Apache HTTP Server before 2.4.69 allows an unauthenticated remote client to corrupt authentication state. It is triggered by concurrent Digest authentication requests only when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. The documented impact is authentication-state corruption and denial of service; code execution is not described. Any platform running a vulnerable build with that Digest configuration is affected. No public proof-of-concept is known and the issue is not in CISA KEV, so exploitation is not known. Do: Upgrade Apache HTTP Server to 2.4.69. Until then, do not enable AuthDigestNcCheck and do not set AuthDigestNonceLifetime to 0; if Digest authentication is not required, unload mod_auth_digest. Check access logs for bursts of concurrent Digest authentication requests against affected hosts. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to...
This source does not provide full text. Read it at seclists.org.