CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack
Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Which configurations are affected?
The issue affects Apache HTTP Server versions before 2.4.69 when mod_auth_digest is in use and either AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Does exploitation require authentication?
No. An unauthenticated remote client can trigger the authentication state corruption by sending concurrent Digest authentication requests.
What is the recommended remediation?
Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.