BIT-apache-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions before 2.4.69 are affected on all platforms if mod_auth_digest is in use and either AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Q: What does an attacker need to exploit it?

An unauthenticated remote client can trigger the issue by sending concurrent Digest authentication requests. No prior authentication or user interaction is required.

Q: What can be done if an immediate upgrade is not possible?

Avoid the affected configurations by disabling AuthDigestNcCheck and ensuring AuthDigestNonceLifetime is not set to 0, where operationally feasible. Upgrading to Apache HTTP Server 2.4.69 is the recommended fix.

Published Oct 1, 2026

Updated

Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

1 affected component

Apache HTTP Server<2.4.69

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·04:18 PM

Data Sourced

via OSV·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions before 2.4.69 are affected on all platforms if mod_auth_digest is in use and either AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

What does an attacker need to exploit it?

An unauthenticated remote client can trigger the issue by sending concurrent Digest authentication requests. No prior authentication or user interaction is required.

What can be done if an immediate upgrade is not possible?

Avoid the affected configurations by disabling AuthDigestNcCheck and ensuring AuthDigestNonceLifetime is not set to 0, where operationally feasible. Upgrading to Apache HTTP Server 2.4.69 is the recommended fix.

BIT-apache-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done if an immediate upgrade is not possible?