Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_proxy_htmlUpgrade httpd-coreUpgrade httpd-filesystemUpgrade httpd-manualUpgrade mod_ldapUpgrade httpd-toolsUpgrade mod_sessionUpgrade httpdUpgrade mod_luaUpgrade mod_sslUpgrade httpd-devel | Oct 25, 2026 | Oct 22, 2026 |
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade httpd-filesystemUpgrade mod_http2Upgrade httpd-develUpgrade httpd-debuginfoUpgrade mod_proxy_htmlUpgrade mod_mdUpgrade mod_sessionUpgrade mod_sslUpgrade mod_ldapUpgrade httpd-manualUpgrade httpdUpgrade httpd-tools | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade mod_http2Upgrade mod_http2-debuginfoUpgrade mod_sslUpgrade httpd-core-debuginfoUpgrade mod_ldap-debuginfoUpgrade httpd-coreUpgrade httpd-debugsourceUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_proxy_htmlUpgrade httpdUpgrade mod_ldapUpgrade mod_session-debuginfoUpgrade mod_lua-debuginfoUpgrade mod_luaUpgrade mod_sessionUpgrade httpd-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade httpd-tools-debuginfoUpgrade httpd-develUpgrade httpd-filesystem | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Oracle_linux | — | Upgrade httpd-toolsUpgrade httpd-coreUpgrade mod_proxy_htmlUpgrade mod_sslUpgrade httpd-manualUpgrade mod_sessionUpgrade httpdUpgrade httpd-filesystemUpgrade mod_ldapUpgrade httpd-develUpgrade mod_lua | Oct 28, 2026 | Oct 1, 2026 |
| Redhat_linux | — | Upgrade mod_luaUpgrade httpdUpgrade mod_sslUpgrade httpd-develUpgrade httpd-debuginfoUpgrade mod_lua-debuginfoNo solution existsUpgrade httpd-tools-debuginfoUpgrade httpd-manualUpgrade httpd-coreUpgrade httpd-debugsourceUpgrade httpd-toolsUpgrade mod_ssl-debuginfoUpgrade mod_proxy_htmlUpgrade mod_ldapUpgrade mod_session-debuginfoUpgrade mod_ldap-debuginfoUpgrade httpd-filesystemUpgrade mod_proxy_html-debuginfoUpgrade httpd-core-debuginfoUpgrade mod_session | Oct 5, 2026 | Oct 1, 2026 |
| Rocky_linux | — | Upgrade httpd-toolsUpgrade mod_luaUpgrade httpd-develUpgrade httpd-coreUpgrade mod_ssl-debuginfoUpgrade httpd-tools-debuginfoUpgrade httpd-core-debuginfoUpgrade httpdUpgrade mod_proxy_html-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_lua-debuginfoUpgrade mod_session-debuginfoUpgrade mod_ldapUpgrade mod_sessionUpgrade httpd-debuginfoUpgrade httpd-debugsourceUpgrade mod_sslUpgrade mod_proxy_html | Oct 26, 2026 | Oct 23, 2026 |
| Ubuntu | — | Upgrade apache2-devUpgrade apache2-suexec-customUpgrade apache2.2-bin (Ubuntu Pro)Upgrade libapache2-mod-proxy-uwsgiUpgrade libapache2-mod-mdUpgrade apache2-bin (Ubuntu Pro)Upgrade apache2-suexec-pristine (Ubuntu Pro)Upgrade libapache2-mod-proxy-html (Ubuntu Pro)Upgrade apache2-ssl-dev (Ubuntu Pro)Upgrade apache2-binUpgrade apache2-mpm-itk (Ubuntu Pro)Upgrade apache2-suexec-pristineUpgrade apache2-mpm-worker (Ubuntu Pro)Upgrade apache2-utilsUpgrade apache2-utils (Ubuntu Pro)Upgrade apache2 (Ubuntu Pro)Upgrade apache2-mpm-event (Ubuntu Pro)Upgrade apache2-ssl-devUpgrade apache2-mpm-prefork (Ubuntu Pro)Upgrade libapache2-mod-macro (Ubuntu Pro)Upgrade apache2Upgrade libapache2-mod-md (Ubuntu Pro)Upgrade apache2-suexec-custom (Ubuntu Pro)Upgrade apache2-suexec (Ubuntu Pro)Upgrade apache2-dev (Ubuntu Pro)Upgrade libapache2-mod-proxy-uwsgi (Ubuntu Pro) | Oct 15, 2026 | Oct 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub