Authentication Bypass in Apache HTTP Server by Apache Software Foundation

CVE-2026-73636

What is CVE-2026-73636?

A vulnerability in mod_auth_digest of Apache HTTP Server 2.4.x can be exploited through an authentication bypass. This occurs when an attacker executes a man-in-the-middle (MITM) attack to replay captured digest authentication credentials. The exploitation is facilitated by crafted requests that induce garbage collection in the client's shared memory entry, particularly when the AuthDigestNonceLifetime is set to 0. It is essential for users to upgrade to version 2.4.69 to mitigate this risk.

References