https://seclists.org/oss-sec/2026/q4/26: CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce play attack

Q: What conditions are required for exploitation?

An attacker must be able to act as a man-in-the-middle and capture a client's Digest authentication credentials. Exploitation also requires mod_auth_digest with AuthDigestNonceLifetime set to 0, then crafted requests that trigger garbage collection of the client's shared-memory entry.

Q: Is the default configuration affected?

The issue is described only for deployments where AuthDigestNonceLifetime is set to 0. The provided information does not state whether that is the default setting.

Q: Which deployments should be prioritized for remediation?

Prioritize Apache HTTP Server 2.4.0 through 2.4.68 installations that use mod_auth_digest and have AuthDigestNonceLifetime set to 0, particularly where an attacker could obtain a man-in-the-middle position.

Q: What can be done if an immediate upgrade is not possible?

Avoid the affected configuration by ensuring AuthDigestNonceLifetime is not set to 0. The recommended permanent remediation is upgrading to Apache HTTP Server 2.4.69.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to act as a man-in-the-middle and capture a client's Digest authentication credentials. Exploitation also requires mod_auth_digest with AuthDigestNonceLifetime set to 0, then crafted requests that trigger garbage collection of the client's shared-memory entry.

Is the default configuration affected?

The issue is described only for deployments where AuthDigestNonceLifetime is set to 0. The provided information does not state whether that is the default setting.

Which deployments should be prioritized for remediation?

Prioritize Apache HTTP Server 2.4.0 through 2.4.68 installations that use mod_auth_digest and have AuthDigestNonceLifetime set to 0, particularly where an attacker could obtain a man-in-the-middle position.

What can be done if an immediate upgrade is not possible?

Avoid the affected configuration by ensuring AuthDigestNonceLifetime is not set to 0. The recommended permanent remediation is upgrading to Apache HTTP Server 2.4.69.