UAF in Apache HTTP Server 2.4 mod_auth_digest before 2.4.69
CVE-2026-73637 Published on October 1, 2026

Apache HTTP Server: mod_auth_digest DoS attack
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-73637 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
LOW

Timeline

Report received

fixed in 2.4.x by r1937721 75 days later.

2.4.69 released

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-73637 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2026-73637

Want to know whenever a new CVE is published for Apache HTTP Server? stack.watch will email you.

Apache HTTP Server
 

Affected Versions

Apache Software Foundation Apache HTTP Server: