UBUNTU-CVE-2026-73636: High severity ubuntu/apache2 vulnerability

Q: Which Apache HTTP Server deployments are exposed to this issue?

Apache HTTP Server 2.4.x deployments using mod_auth_digest are affected when AuthDigestNonceLifetime is set to 0. The issue applies on all platforms, including Ubuntu systems running apache2.

Q: What does an attacker need to exploit the authentication bypass?

An attacker must be able to act as a man-in-the-middle and capture Digest authentication credentials. They then replay the captured credentials in crafted requests that trigger garbage collection of the client's shared-memory entry.

Q: Is the default Digest authentication configuration affected?

The provided information identifies the vulnerable condition as AuthDigestNonceLifetime being set to 0. It does not state whether that value is the default configuration.

Q: What remediation is available?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.

Published Oct 1, 2026

Updated

Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

8 affected componentsFixes available

ubuntu/apache2<2.4.7-1ubuntu4.22+esm17

2.4.7-1ubuntu4.22+esm17

ubuntu/apache2<2.4.18-2ubuntu3.17+esm22

2.4.18-2ubuntu3.17+esm22

ubuntu/apache2<2.4.29-1ubuntu4.27+esm13

2.4.29-1ubuntu4.27+esm13

ubuntu/apache2<2.4.41-4ubuntu3.23+esm9

2.4.41-4ubuntu3.23+esm9

ubuntu/apache2<2.4.52-1ubuntu4.25

2.4.52-1ubuntu4.25

ubuntu/apache2<2.4.58-1ubuntu8.17

2.4.58-1ubuntu8.17

ubuntu/apache2*

ubuntu/apache2<2.4.66-2ubuntu2.6

2.4.66-2ubuntu2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.7-1ubuntu4.22+esm17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.18-2ubuntu3.17+esm22
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.29-1ubuntu4.27+esm13
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.41-4ubuntu3.23+esm9
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.52-1ubuntu4.25
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.58-1ubuntu8.17
Upgrade
Upgrade ubuntu/apache2 to a version that resolves this vulnerability.
Fixed in 2.4.66-2ubuntu2.6
Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed to this issue?

Apache HTTP Server 2.4.x deployments using mod_auth_digest are affected when AuthDigestNonceLifetime is set to 0. The issue applies on all platforms, including Ubuntu systems running apache2.

What does an attacker need to exploit the authentication bypass?

An attacker must be able to act as a man-in-the-middle and capture Digest authentication credentials. They then replay the captured credentials in crafted requests that trigger garbage collection of the client's shared-memory entry.

Is the default Digest authentication configuration affected?

The provided information identifies the vulnerable condition as AuthDigestNonceLifetime being set to 0. It does not state whether that value is the default configuration.

What remediation is available?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.

UBUNTU-CVE-2026-73636: High severity ubuntu/apache2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed to this issue?

What does an attacker need to exploit the authentication bypass?

Is the default Digest authentication configuration affected?

What remediation is available?

Company

Resources

Contact

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed to this issue?

What does an attacker need to exploit the authentication bypass?

Is the default Digest authentication configuration affected?

What remediation is available?