OESA-2026-4636: httpd security update

Q: Which deployments are most exposed to the denial-of-service issue?

Deployments using mod_auth_digest with Digest authentication enabled and AuthDigestNcCheck configured are exposed to forged Authorization headers that can force re-authentication. The issue affects Apache HTTP Server versions before 2.4.69 on all platforms.

Q: What conditions are required for the credential replay issue?

An attacker must be in a man-in-the-middle position and able to replay captured Digest authentication credentials. The described replay condition requires AuthDigestNonceLifetime to be set to 0 and affects Apache HTTP Server 2.4.x on all platforms.

Q: Can an unauthenticated attacker trigger the authentication-state corruption issue?

Yes. The advisory states that an unauthenticated remote client can cause authentication state corruption through concurrent Digest authentication requests in affected versions before 2.4.69.

Q: What should be done if affected Digest authentication configurations are in use?

Upgrade Apache HTTP Server to version 2.4.69, which the advisory identifies as fixing the listed issues. The supplied information does not provide an alternative mitigation for systems that cannot yet be upgraded.

Published Oct 29, 2026

Updated

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es):

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .

Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-48005)

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-73636)

Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.(CVE-2026-73637)

Affected Software

1 affected componentFixes available

openeuler/httpd<2.4.58-25.oe2403sp3

2.4.58-25.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/httpd to a version that resolves this vulnerability.
Fixed in 2.4.58-25.oe2403sp3
Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are most exposed to the denial-of-service issue?

Deployments using mod_auth_digest with Digest authentication enabled and AuthDigestNcCheck configured are exposed to forged Authorization headers that can force re-authentication. The issue affects Apache HTTP Server versions before 2.4.69 on all platforms.

What conditions are required for the credential replay issue?

An attacker must be in a man-in-the-middle position and able to replay captured Digest authentication credentials. The described replay condition requires AuthDigestNonceLifetime to be set to 0 and affects Apache HTTP Server 2.4.x on all platforms.

Can an unauthenticated attacker trigger the authentication-state corruption issue?

Yes. The advisory states that an unauthenticated remote client can cause authentication state corruption through concurrent Digest authentication requests in affected versions before 2.4.69.

What should be done if affected Digest authentication configurations are in use?

Upgrade Apache HTTP Server to version 2.4.69, which the advisory identifies as fixing the listed issues. The supplied information does not provide an alternative mitigation for systems that cannot yet be upgraded.

OESA-2026-4636: httpd security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are most exposed to the denial-of-service issue?

What conditions are required for the credential replay issue?

Can an unauthenticated attacker trigger the authentication-state corruption issue?

What should be done if affected Digest authentication configurations are in use?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to the denial-of-service issue?

What conditions are required for the credential replay issue?

Can an unauthenticated attacker trigger the authentication-state corruption issue?

What should be done if affected Digest authentication configurations are in use?