CVE-2026-73637
Apache Http Server: use-after-free
- Risk score
- 67/100
- CVSS
- 7.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. User…
- Affected
- Apache Http Server before 2.4.69
- Fix
- Upgrade Apache Http Server to 2.4.69 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Http Server: Red, act today. Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
The flaws
- CVE-2026-73637: Use-after-free (CVSS 7.3 · EPSS 0%)
- CVE-2026-57941: Use-after-free (CVSS 9.8 · EPSS 1%)
- CVE-2026-56154: Use-after-free (CVSS 9.8 · EPSS 1%)
- CVE-2026-59797: Privilege escalation (CVSS 9.8 · EPSS 1%)
The fix
Upgrade Apache Http Server: 2.4.69 or later on your release line
Who is exposed: Apache Http Server
Where it stands
- No known exploitation
Connects to
- Same weakness: Use-after-free (CWE-416). 397 other warnings in 30 days
- Same product: Earlier Apache Http Server warnings. 16 in the last 90 days
Why it is Amber
- CVSS 7.3 high
- Remotely exploitable without logging in
- On your watchlist: apache http server
References
Original description
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Last activity 1 Oct 2026. Patch Forecast updates every hour.