CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The server must use mod_auth_digest with AuthDigestNonceLifetime set to 0. An attacker must be able to act as a man-in-the-middle and capture digest authentication credentials, then send crafted requests that trigger garbage collection of the client's shared-memory entry.
Are default deployments affected?
The issue is specifically described for configurations where AuthDigestNonceLifetime is set to 0. The provided information does not state whether that setting is the default.
What is the recommended remediation?
Upgrade Apache HTTP Server 2.4.x to version 2.4.69, which fixes the issue.