Status: UPDATED | Advisory ID: CVE-2026-73637
| CVE | CVE-2026-73637 |
| CVSS Score / Version | 7.3 (High) / CVSS v3.1 |
| Updated | 2026-10-01 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is low; integrity impact is low; availability impact is low. |
| Affected products | Apache Software Foundation Apache HTTP Server |
| Classified as | CWE-416 (Use After Free) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
| Subsystems | General OT |
| Sectors | Multiple |
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue. (NVD)
Monitor Apache Software Foundation's web page for any future patch releases.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-73637 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-73637 |