PT-2026-103940 · Apache · Apache Http Server

Hyojae Lee

·

CVE-2026-73636

·

Publicado

2026-10-01

·

Atualizado

2026-10-01

CVSS v3.1

8.1

Alta

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Authentication bypass by capture-replay in mod auth digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-294

Identificadores relacionados

CVE-2026-73636

Produtos afetados

Apache Http Server