---
id: CVE-2026-73637
title: >-
  Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP
  Server before 2.4.69 on all platforms allows an unauthenticated remote client
  to cause authentication state corruption via concurrent Digest authentication
  reque…
summary: >-
  Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP
  Server before 2.4.69 on all platforms allows an unauthenticated remote client
  to cause authentication state corruption via concurrent Digest authentication
  reque…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-416
  - CWE-825
vendor: apache
product: http_server
affected:
  - 'http_server >= 2.4.0, < 2.4.69'
patched:
  - http_server 2.4.69
published: '2026-10-01'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T17:39:38.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73637'
references:
  - url: 'https://httpd.apache.org/security/vulnerabilities_24.html'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/10/01/28'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73637.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-73637'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544814'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73637'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73637'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74858'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00466
epssPercentile: 0.40175
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-01T19:42:16.346387Z'
scores:
  nvd: 7.3
  vendor: 5.6
ingestedAt: '2026-10-01T18:55:42.365Z'
---

## Overview

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

## Affected

- `http_server >= 2.4.0, < 2.4.69`

## Remediation

Upgrade past the affected range:

- `http_server 2.4.69`

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73637.json)
- **RHSA-2026:74858** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:74858)