CVE-2026-73637

A flaw was found in httpd's mod_auth_digest module. A use-after-free vulnerability allows an unauthenticated remote attacker to corrupt the server's authentication state by submitting concurrent Digest authentication requests. This issue occurs when specific configuration settings, such as nonce checking (AuthDigestNcCheck) or zero-duration nonce lifetimes (AuthDigestNonceLifetime), are enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, apply one of the following configuration options:

1. Disable mod_auth_digest if Digest authentication is not required: In /etc/httpd/conf.modules.d/00-base.conf (or the relevant module configuration file), comment out the loading of the module:

# LoadModule auth_digest_module modules/mod_auth_digest.so

2. If Digest authentication is required, ensure vulnerable settings are disabled: Ensure AuthDigestNcCheck is set to Off (or removed, as Off is the default) and ensure AuthDigestNonceLifetime is not set to 0 (the default value is 300 seconds).

After applying configuration adjustments, reload the web server:

systemctl reload httpd

Warning: Reloading or restarting the httpd service may briefly disrupt active client connections. Disabling mod_auth_digest will cause authentication failures for resources configured with AuthType Digest.