CVE-2026-73636
Publication date 1 October 2026
Last updated 11 November 2026
Ubuntu priority
Description
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| apache2 | 26.10 stonking |
Fixed in 2.4.68-1ubuntu6.1
|
| 26.04 LTS resolute |
Fixed in 2.4.66-2ubuntu2.6
|
|
| 24.04 LTS noble |
Fixed in 2.4.58-1ubuntu8.17
|
|
| 22.04 LTS jammy |
Fixed in 2.4.52-1ubuntu4.25
|
|
| 20.04 LTS focal |
Fixed in 2.4.41-4ubuntu3.23+esm9
|
|
| 18.04 LTS bionic |
Fixed in 2.4.29-1ubuntu4.27+esm13
|
|
| 16.04 LTS xenial |
Fixed in 2.4.18-2ubuntu3.17+esm22
|
|
| 14.04 LTS trusty |
Fixed in 2.4.7-1ubuntu4.22+esm17
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
8.1 · High
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8931-1
- Apache HTTP Server vulnerabilities
- 14 October 2026
- USN-9016-1
- Apache HTTP Server vulnerabilities
- 10 November 2026