CVE-2026-73637: CWE-416 Use After Free in Apache Software Foundation Apache HTTP Server
CVE-2026-73637 is a use-after-free vulnerability in the mod_auth_digest module of Apache HTTP Server versions 2.4.0 through 2.4.68. It allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when specific configuration options are enabled. The issue is fixed in Apache HTTP Server version 2.4.69.
AI Analysis
Technical Summary
This vulnerability involves a use-after-free condition in the mod_auth_digest component of Apache HTTP Server before version 2.4.69. When the AuthDigestNcCheck directive is enabled or AuthDigestNonceLifetime is set to 0, an unauthenticated remote attacker can trigger concurrent Digest authentication requests that corrupt the authentication state. This flaw affects all platforms running affected versions and is resolved by upgrading to version 2.4.69.
Potential Impact
An unauthenticated remote attacker can cause authentication state corruption, potentially affecting the integrity of Digest authentication processes. The vulnerability may disrupt normal authentication behavior but no further exploitation details or impacts are provided.
Mitigation Recommendations
Users should upgrade Apache HTTP Server to version 2.4.69 or later, which contains the official fix for this vulnerability. No other mitigation actions are indicated.
CVE-2026-73637: CWE-416 Use After Free in Apache Software Foundation Apache HTTP Server
Description
CVE-2026-73637 is a use-after-free vulnerability in the mod_auth_digest module of Apache HTTP Server versions 2.4.0 through 2.4.68. It allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when specific configuration options are enabled. The issue is fixed in Apache HTTP Server version 2.4.69.
Affected software
Apache Software Foundation
Apache HTTP Server
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a use-after-free condition in the mod_auth_digest component of Apache HTTP Server before version 2.4.69. When the AuthDigestNcCheck directive is enabled or AuthDigestNonceLifetime is set to 0, an unauthenticated remote attacker can trigger concurrent Digest authentication requests that corrupt the authentication state. This flaw affects all platforms running affected versions and is resolved by upgrading to version 2.4.69.
Potential Impact
An unauthenticated remote attacker can cause authentication state corruption, potentially affecting the integrity of Digest authentication processes. The vulnerability may disrupt normal authentication behavior but no further exploitation details or impacts are provided.
Mitigation Recommendations
Users should upgrade Apache HTTP Server to version 2.4.69 or later, which contains the official fix for this vulnerability. No other mitigation actions are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-13T12:48:43.755Z
- State
- PUBLISHED
Threat ID: 6abe8b02a43b0b3b89c7c759
Added to database: 10/01/2026, 16:32:02 UTC
Last enriched: 10/01/2026, 16:47:14 UTC
Last updated: 10/01/2026, 17:01:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.