The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_ldapUpgrade httpd-toolsUpgrade httpd-filesystemUpgrade httpd-manualUpgrade httpd-coreUpgrade mod_proxy_htmlUpgrade httpd-develUpgrade mod_sslUpgrade mod_luaUpgrade httpdUpgrade mod_session | Oct 25, 2026 | Oct 22, 2026 |
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade httpd-toolsUpgrade mod_ldapUpgrade mod_sessionUpgrade mod_mdUpgrade mod_sslUpgrade httpd-manualUpgrade httpdUpgrade httpd-develUpgrade mod_http2Upgrade mod_proxy_htmlUpgrade httpd-filesystemUpgrade httpd-debuginfo | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade httpd-toolsUpgrade mod_http2Upgrade httpd-coreUpgrade mod_proxy_htmlUpgrade mod_http2-debuginfoUpgrade mod_ldap-debuginfoUpgrade httpd-debugsourceUpgrade httpd-core-debuginfoUpgrade httpd-manualUpgrade mod_sslUpgrade httpd-develUpgrade httpd-filesystemUpgrade mod_sessionUpgrade mod_luaUpgrade httpd-debuginfoUpgrade mod_lua-debuginfoUpgrade mod_session-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade httpd-tools-debuginfoUpgrade mod_ldapUpgrade httpd | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Oracle_linux | — | Upgrade httpd-toolsUpgrade httpd-manualUpgrade mod_proxy_htmlUpgrade mod_sslUpgrade httpd-coreUpgrade httpdUpgrade httpd-filesystemUpgrade mod_sessionUpgrade httpd-develUpgrade mod_luaUpgrade mod_ldap | Oct 28, 2026 | Oct 1, 2026 |
| Redhat_linux | — | Upgrade httpd-core-debuginfoUpgrade mod_ldapUpgrade mod_proxy_html-debuginfoUpgrade mod_proxy_htmlUpgrade mod_ssl-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_sessionUpgrade httpd-filesystemUpgrade mod_session-debuginfoUpgrade httpd-debuginfoUpgrade httpd-debugsourceUpgrade mod_lua-debuginfoNo solution existsUpgrade httpd-tools-debuginfoUpgrade httpd-manualUpgrade httpd-toolsUpgrade mod_sslUpgrade httpd-coreUpgrade httpd-develUpgrade httpdUpgrade mod_lua | Oct 5, 2026 | Oct 1, 2026 |
| Rocky_linux | — | Upgrade httpd-core-debuginfoUpgrade mod_ssl-debuginfoUpgrade httpdUpgrade httpd-coreUpgrade mod_luaUpgrade httpd-tools-debuginfoUpgrade httpd-develUpgrade httpd-toolsUpgrade mod_proxy_htmlUpgrade mod_proxy_html-debuginfoUpgrade mod_sslUpgrade mod_ldap-debuginfoUpgrade httpd-debugsourceUpgrade mod_sessionUpgrade mod_lua-debuginfoUpgrade mod_session-debuginfoUpgrade mod_ldapUpgrade httpd-debuginfo | Oct 26, 2026 | Oct 23, 2026 |
| Ubuntu | — | Upgrade libapache2-mod-md (Ubuntu Pro)Upgrade apache2-suexec (Ubuntu Pro)Upgrade apache2-mpm-prefork (Ubuntu Pro)Upgrade apache2-ssl-devUpgrade apache2-suexec-custom (Ubuntu Pro)Upgrade libapache2-mod-macro (Ubuntu Pro)Upgrade apache2Upgrade libapache2-mod-proxy-uwsgi (Ubuntu Pro)Upgrade apache2-suexec-pristineUpgrade apache2-utils (Ubuntu Pro)Upgrade apache2-mpm-event (Ubuntu Pro)Upgrade apache2 (Ubuntu Pro)Upgrade apache2-dev (Ubuntu Pro)Upgrade apache2-mpm-worker (Ubuntu Pro)Upgrade apache2-utilsUpgrade apache2.2-bin (Ubuntu Pro)Upgrade apache2-devUpgrade apache2-suexec-customUpgrade libapache2-mod-proxy-uwsgiUpgrade apache2-binUpgrade libapache2-mod-mdUpgrade apache2-suexec-pristine (Ubuntu Pro)Upgrade apache2-bin (Ubuntu Pro)Upgrade libapache2-mod-proxy-html (Ubuntu Pro)Upgrade apache2-ssl-dev (Ubuntu Pro)Upgrade apache2-mpm-itk (Ubuntu Pro) | Oct 15, 2026 | Oct 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub