https://seclists.org/oss-sec/2026/q4/27: CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected on all platforms, but exploitation requires mod_auth_digest with either AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0.

Q: Does an attacker need valid credentials to trigger the problem?

No. An unauthenticated remote client can trigger authentication state corruption by sending concurrent Digest authentication requests.

Q: What should be done if an affected configuration cannot be upgraded immediately?

The provided information identifies the affected conditions as AuthDigestNcCheck being enabled or AuthDigestNonceLifetime being set to 0. Avoiding those conditions may reduce exposure until an upgrade can be performed; the recommended remediation is upgrading to Apache HTTP Server 2.4.69.

Q: How can I determine whether my server is affected?

Check whether the server runs Apache HTTP Server 2.4.0 through 2.4.68 and whether mod_auth_digest is configured with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0. Version 2.4.69 contains the fix.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected on all platforms, but exploitation requires mod_auth_digest with either AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0.

Does an attacker need valid credentials to trigger the problem?

No. An unauthenticated remote client can trigger authentication state corruption by sending concurrent Digest authentication requests.

What should be done if an affected configuration cannot be upgraded immediately?

The provided information identifies the affected conditions as AuthDigestNcCheck being enabled or AuthDigestNonceLifetime being set to 0. Avoiding those conditions may reduce exposure until an upgrade can be performed; the recommended remediation is upgrading to Apache HTTP Server 2.4.69.

How can I determine whether my server is affected?

Check whether the server runs Apache HTTP Server 2.4.0 through 2.4.68 and whether mod_auth_digest is configured with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0. Version 2.4.69 contains the fix.