CVE-2026-73637

HIGHCVSS 7.3

Description

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Timeline

Published:October 1st, 2026 5:17 PM

Last modified:October 5th, 2026 5:39 PM

CVSS Scoring

CVSS v3: 7.3 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected Software

From NVD CPE configuration data

Vendors

apache

Products

http_server

Weaknesses (CWE)

CWE-416

References & Reports

Advisories, patches, and third-party reports

https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/01/28Mailing List

Source: NIST NVD · Data may lag official sources by up to one minute