OESA-2026-4635: httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):
Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-48005)
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-73636)
Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-73637)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/httpdto a version that resolves this vulnerability.Fixed in 2.4.51-38.oe2203sp4 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are exposed to the forced re-authentication issue?
Deployments using mod_auth_digest are exposed when Digest authentication is enabled with AuthDigestNcCheck. The issue affects Apache HTTP Server versions before 2.4.69 on all platforms.
What access does an attacker need?
The forced re-authentication and authentication-state-corruption issues can be triggered by an unauthenticated remote client. The credential replay issue requires a man-in-the-middle attacker who can capture digest authentication credentials.
Which configuration makes the credential replay issue relevant?
The replay issue applies to Apache HTTP Server 2.4.x installations using mod_auth_digest when AuthDigestNonceLifetime is set to 0. Under that condition, crafted requests can trigger garbage collection of the client's shared-memory entry and enable replay of captured credentials.
What should be done if an affected configuration is identified?
Upgrade Apache HTTP Server to version 2.4.69, which is identified as fixing these issues. Review Digest authentication configurations for AuthDigestNcCheck and AuthDigestNonceLifetime set to 0 to determine whether the described conditions are present.