CVE-2026-73637
published 2026-10-01CVE-2026-73637: Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to…
PriorityP353high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.48%
40.7th percentile
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via c
ghsa_unreviewed·2026-10-01
CVE-2026-73637 [HIGH] CWE-416 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via c
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Red Hat
httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
vendor_redhat·2026-10-01·CVSS 7.3
CVE-2026-73637 [HIGH] CWE-825 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in httpd's mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDige
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73637 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests [fedora-all]
bugzilla·2026-10-02·CVSS 7.3
CVE-2026-73637 [HIGH] CVE-2026-73637 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests [fedora-all]
CVE-2026-73637 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Bugzilla
CVE-2026-73637 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
bugzilla·2026-10-01·CVSS 7.3
CVE-2026-73637 [HIGH] CVE-2026-73637 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
CVE-2026-73637 httpd: httpd: Authentication state corruption via concurrent Digest authentication requests
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
2026-10-01
Published