CVE-2026-73637
Received Received - Intake

Use After Free in Apache HTTP Server mod_auth_digest

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-73637
EUVD
EUVD-2026-90908

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache_software_foundation apache_http_server 2.4.69

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in mod_auth_digest of Apache HTTP Server versions before 2.4.69. It occurs when an unauthenticated remote client sends concurrent Digest authentication requests with specific configurations enabled. This can corrupt the authentication state of the server.

Detection Guidance

This vulnerability can be detected by checking the Apache HTTP Server version. Run 'httpd -v' or 'apache2 -v' to see the installed version. If it is below 2.4.69, the system is vulnerable. Additionally, verify if AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0 in the Apache configuration files.

Impact Analysis

An attacker could exploit this to cause denial of service or potentially execute arbitrary code on the affected server. This may lead to unauthorized access or disruption of services relying on Apache HTTP Server.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing authentication state corruption, which could lead to unauthorized access or data breaches. Unauthenticated remote clients exploiting this flaw might compromise user credentials or session integrity, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Apache HTTP Server to version 2.4.69 or later immediately. After upgrading, restart the Apache service to apply the changes. Review and adjust the AuthDigestNcCheck and AuthDigestNonceLifetime settings in the configuration files to ensure they are not set in a vulnerable manner.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart