Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a… (CVE-2026-73636)
A vulnerability in mod_auth_digest of Apache HTTP Server 2.4.x allows an attacker to bypass authentication by replaying captured digest credentials. This occurs when AuthDigestNonceLifetime is set to 0, enabling a man-in-the-middle attacker to trigger garbage collection of the client's shared memory entry and reuse authentication data. The issue affects all platforms running Apache HTTP Server 2.4.x. Users are advised to upgrade to version 2.4.69, which addresses this vulnerability.
AI Analysis
Technical Summary
CVE-2026-73636 describes an authentication bypass vulnerability in the mod_auth_digest module of Apache HTTP Server 2.4.x. When the AuthDigestNonceLifetime parameter is configured to 0, an attacker capable of man-in-the-middle interception can replay previously captured digest authentication credentials. This replay attack exploits the garbage collection of the client's shared memory entry, allowing unauthorized access. The vulnerability affects all platforms running Apache HTTP Server 2.4.x. The Apache Software Foundation has fixed this issue in version 2.4.69.
Potential Impact
An attacker with man-in-the-middle capabilities can bypass authentication by replaying captured digest credentials, potentially gaining unauthorized access to protected resources on servers running vulnerable versions of Apache HTTP Server 2.4.x. This compromises the authentication mechanism and could lead to unauthorized actions or data exposure depending on server configuration.
Mitigation Recommendations
Users should upgrade Apache HTTP Server to version 2.4.69 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 2.4.69.
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a… (CVE-2026-73636)
Description
A vulnerability in mod_auth_digest of Apache HTTP Server 2.4.x allows an attacker to bypass authentication by replaying captured digest credentials. This occurs when AuthDigestNonceLifetime is set to 0, enabling a man-in-the-middle attacker to trigger garbage collection of the client's shared memory entry and reuse authentication data. The issue affects all platforms running Apache HTTP Server 2.4.x. Users are advised to upgrade to version 2.4.69, which addresses this vulnerability.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73636 describes an authentication bypass vulnerability in the mod_auth_digest module of Apache HTTP Server 2.4.x. When the AuthDigestNonceLifetime parameter is configured to 0, an attacker capable of man-in-the-middle interception can replay previously captured digest authentication credentials. This replay attack exploits the garbage collection of the client's shared memory entry, allowing unauthorized access. The vulnerability affects all platforms running Apache HTTP Server 2.4.x. The Apache Software Foundation has fixed this issue in version 2.4.69.
Potential Impact
An attacker with man-in-the-middle capabilities can bypass authentication by replaying captured digest credentials, potentially gaining unauthorized access to protected resources on servers running vulnerable versions of Apache HTTP Server 2.4.x. This compromises the authentication mechanism and could lead to unauthorized actions or data exposure depending on server configuration.
Mitigation Recommendations
Users should upgrade Apache HTTP Server to version 2.4.69 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 2.4.69.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x3h4-7828-fv9v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73636"]
- State
- PUBLISHED
Threat ID: 6abeb3e3a43b0b3b89eceaf3
Added to database: 10/01/2026, 19:26:27 UTC
Last enriched: 10/01/2026, 19:27:45 UTC
Last updated: 10/02/2026, 03:45:56 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.