CVE-2026-73636

A flaw was found in the mod_auth_digest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce (a single-use security token) lifetime of zero, an attacker can send crafted requests that prematurely clear the client session entry from shared memory, enabling unauthorized access using the replayed credentials.

Red Hat rates this vulnerability as Important because an attacker capable of eavesdropping on network traffic can replay captured credentials to bypass access controls, leading to a complete compromise of protected resources. Exploitation depends on an explicit, non-default configuration where the AuthDigestNonceLifetime directive is configured to zero, inducing shared-memory session eviction. Red Hat Enterprise Linux does not configure or enable digest authentication by default, significantly reducing out-of-the-box exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure that AuthDigestNonceLifetime is not set to 0. If digest authentication is not required, disable mod_auth_digest.

1. To retain digest authentication with safe settings, set a positive non-zero value (such as the default 300 seconds) or remove the explicit zero setting from /etc/httpd/conf/httpd.conf or relevant files in /etc/httpd/conf.d/:

AuthDigestNonceLifetime 300

2. If HTTP digest authentication is not needed, disable the module by commenting out the corresponding line in /etc/httpd/conf.modules.d/00-base.conf:

#LoadModule auth_digest_module modules/mod_auth_digest.so

3. Restart the web server to apply changes:

systemctl restart httpd

Warning: Restarting or reloading the httpd service will briefly disrupt active client connections. Disabling the module will break authentication for virtual hosts or directories relying on digest authentication.