Apache HTTP Server CVE-2026-73637

Exploitation requires that mod_auth_digest is loaded and Digest authentication is actively configured on the server, AND one of two specific non-default settings is in effect: the AuthDigestNcCheck directive is enabled, or AuthDigestNonceLifetime is set to 0. Beyond configuration, the flaw is a concurrency/race condition - the attacker must send concurrent Digest authentication requests to hit the use-after-free window, so single or serialized requests will not reliably trigger it. These two factors (non-default directive state plus a timing-dependent race) are the primary limiters and mean default Apache installations, and those using Basic auth or other auth modules, are not affected. Per the description the client need not be authenticated, but the CVSS vector needed to confirm the privilege requirement was not provided.

No quantitative risk signals were supplied with this CVE: CVSS score and vector are N/A, no EPSS probability is provided, there is no CISA KEV listing, and no POC is referenced - the only source is the Apache vendor advisory. Risk must therefore be inferred from the description and CWE-416. The vulnerability is network-reachable and, per the description, triggerable by an unauthenticated client, which raises its nominal reach; however, exploitation is gated hard by two non-default prerequisites (mod_auth_digest must be actively used for Digest authentication AND either AuthDigestNcCheck must be enabled or AuthDigestNonceLifetime must be set to 0) and by a concurrency/race condition requiring simultaneous requests, which materially lowers reliable exploitability. The tagged impact is Denial of Service / memory corruption, and the described outcome is 'authentication state corruption,' consistent with a crash or inconsistent auth state rather than confirmed remote code execution. Net: despite Apache HTTP Server's ubiquity, the real-world priority is tempered - this is a conditional, config-dependent, race-based defect, not a drop-everything RCE. CONFLICTING/MISSING DATA: the description asserts 'unauthenticated remote client' but NO CVSS vector is provided, so the authentication requirement cannot be confirmed from a PR metric - verify against the vendor advisory before treating auth-bypass reach as established.

An attacker who can reach an Apache HTTP Server (before 2.4.69) that uses mod_auth_digest with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0 sends a burst of concurrent Digest authentication requests to race the nonce-tracking logic, triggering a use-after-free. The resulting memory corruption can corrupt authentication state or crash worker processes, degrading availability. No public exploit code is referenced in the available data, and the required race window plus non-default configuration make reliable exploitation non-trivial.