CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack
Apache HTTP Server: modauthdigest DoS attack
Other sources
Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.69-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Which configurations are affected?
The issue affects Apache HTTP Server versions before 2.4.69 when mod_auth_digest is in use and either AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Does exploitation require authentication?
No. An unauthenticated remote client can trigger the authentication state corruption by sending concurrent Digest authentication requests.
What is the recommended remediation?
Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.