CVE-2026-73636·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.69 or later to patch the digest authentication credential replay vulnerability in mod_auth_digest. This vulnerability allows attackers positioned between clients and servers to intercept and reuse authentication tokens when AuthDigestNonceLifetime is configured to 0. Immediate patching is recommended for all deployments using digest authentication.

sudo dnf update httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /protected-resource HTTP/1.1.*Authorization: Digest.*response=[a-f0-9]{32}.*nonce=[a-f0-9]+.*nc=00000002

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement ModSecurity rules to detect multiple Digest authentication responses using identical nonce values within short time windows; flag requests with Digest response fields appearing in rapid succession as potential replay attempts and rate-limit or block such traffic.

How to check if you are affected

1. Check installed Apache version: apachectl -v or httpd -v; verify it is 2.4.69 or later
2. Verify if mod_auth_digest is enabled: apache2ctl -M | grep digest_module (Ubuntu/Debian) or httpd -M | grep digest_module (RHEL/CentOS)
3. Check Apache configuration for AuthDigestNonceLifetime set to 0: grep -r 'AuthDigestNonceLifetime 0' /etc/apache2/ or /etc/httpd/
4. Confirm patch applied by running: dpkg -l | grep apache2 (Debian-based) or rpm -qa | grep httpd (RHEL-based) and verify version is 2.4.69+

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2026/10/01/27