CVE-2026-73637
Publication date 1 October 2026
Last updated 17 October 2026
Ubuntu priority
Description
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| apache2 | 26.10 stonking |
Vulnerable
|
| 26.04 LTS resolute |
Fixed in 2.4.66-2ubuntu2.6
|
|
| 24.04 LTS noble |
Fixed in 2.4.58-1ubuntu8.17
|
|
| 22.04 LTS jammy |
Fixed in 2.4.52-1ubuntu4.25
|
|
| 20.04 LTS focal |
Fixed in 2.4.41-4ubuntu3.23+esm9
|
|
| 18.04 LTS bionic |
Fixed in 2.4.29-1ubuntu4.27+esm13
|
|
| 16.04 LTS xenial |
Fixed in 2.4.18-2ubuntu3.17+esm22
|
|
| 14.04 LTS trusty |
Fixed in 2.4.7-1ubuntu4.22+esm17
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
7.3 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
Related Ubuntu Security Notices (USN)
- USN-8931-1
- Apache HTTP Server vulnerabilities
- 14 October 2026