Apache HTTP Server: Authentication bypass by capture-replay in mod_auth_digest

Summary

The mod_auth_digest module of Apache HTTP Server 2.4.x on all platforms can be abused to bypass Digest authentication by capture-replay. A man-in-the-middle attacker who captures Digest credentials can replay them via crafted requests that trigger garbage collection of the client's shared memory entry. The attack only works when AuthDigestNonceLifetime is set to 0, which is not the default (300 seconds).

Affected

• Apache HTTP Server 2.4.0 through 2.4.68
• Only with mod_auth_digest loaded, AuthType Digest in use and AuthDigestNonceLifetime 0
• Default configuration is unaffected according to the CVE record

Fixed in

• Apache HTTP Server 2.4.69 (released 2026-10-01)

Workaround

• Set AuthDigestNonceLifetime to a non-zero value if Digest authentication is used (own assessment, not from a vendor source; check client impact first)
• Enforce HTTPS for all Digest-protected content, as Digest does not provide confidentiality

Exploitation

• No exploitation confirmed in the wild and no public proof of concept found
• CISA SSVC: exploitation none, automatable no, technical impact total
• Not listed in the CISA KEV catalogue according to secondary sources (not verified)

Our recommendation

• Inventory Apache instances and check the configuration for AuthType Digest and AuthDigestNonceLifetime (for example with grep -ri)
• Upgrade to Apache HTTP Server 2.4.69 where mod_auth_digest is used, and test first, as some configurations (AuthDigestQop none, authdigest-opaque mutex, RFC 2069 clients) may no longer work
• Verify whether a reload or SIGHUP restart re-accepts a captured request; a third-party advisory reports this is not fully fixed in 2.4.69 (unverified)
• Ensure HTTPS is enforced and TLS is properly configured
• Note that Apache rates the issue as low, while the CVSS score is 8.1; the attack requires a man-in-the-middle position

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache HTTP Server 2.4 vulnerabilities httpd.apache.org
• oss-security post CVE-2026-73636 www.openwall.com
• Ubuntu security CVE-2026-73636 ubuntu.com
• Clear Linux advisory via OSV (third party) osv.dev
• HKCERT security bulletin www.hkcert.org
• Apache mod_auth_digest documentation httpd.apache.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:01.