BIT-apache-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Q: Which deployments are exposed to this issue?

Apache HTTP Server 2.4.x deployments using mod_auth_digest are affected when AuthDigestNonceLifetime is set to 0. The issue applies on all platforms.

Q: What does an attacker need to exploit it?

An attacker must be positioned as a man in the middle and able to capture digest authentication credentials. They can replay those credentials using crafted requests that trigger garbage collection of the client's shared-memory entry.

Q: Is the default configuration affected?

The provided information identifies AuthDigestNonceLifetime set to 0 as the affected condition, but does not state whether that is the default setting.

Q: What should be done to remediate the issue?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue. If an immediate upgrade is not possible, avoid configuring AuthDigestNonceLifetime to 0.

Published Oct 1, 2026

Updated

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

1 affected component

Apache HTTP Server<2.4.69

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server mod_auth_digest to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server 2.4.x deployments using mod_auth_digest are affected when AuthDigestNonceLifetime is set to 0. The issue applies on all platforms.

What does an attacker need to exploit it?

An attacker must be positioned as a man in the middle and able to capture digest authentication credentials. They can replay those credentials using crafted requests that trigger garbage collection of the client's shared-memory entry.

Is the default configuration affected?

The provided information identifies AuthDigestNonceLifetime set to 0 as the affected condition, but does not state whether that is the default setting.

What should be done to remediate the issue?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue. If an immediate upgrade is not possible, avoid configuring AuthDigestNonceLifetime to 0.

BIT-apache-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Is the default configuration affected?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Is the default configuration affected?

What should be done to remediate the issue?