The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade httpd-coreUpgrade httpd-filesystemUpgrade mod_ldapUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_proxy_htmlUpgrade mod_sessionUpgrade httpd-develUpgrade mod_luaUpgrade mod_sslUpgrade httpd | Oct 25, 2026 | Oct 22, 2026 |
| Alpine Linux | — | Upgrade apache2 | Oct 5, 2026 | Oct 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade mod_sessionUpgrade httpd-toolsUpgrade mod_ldapUpgrade mod_sslUpgrade mod_mdUpgrade httpdUpgrade httpd-manualUpgrade httpd-debuginfoUpgrade mod_http2Upgrade mod_proxy_htmlUpgrade httpd-develUpgrade httpd-filesystem | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade mod_session-debuginfoUpgrade httpd-filesystemUpgrade httpd-tools-debuginfoUpgrade mod_ldapUpgrade mod_proxy_html-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_lua-debuginfoUpgrade httpdUpgrade httpd-develUpgrade mod_sessionUpgrade httpd-debuginfoUpgrade mod_luaUpgrade mod_http2Upgrade httpd-coreUpgrade mod_sslUpgrade mod_ldap-debuginfoUpgrade httpd-core-debuginfoUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_proxy_htmlUpgrade httpd-debugsourceUpgrade mod_http2-debuginfo | Oct 13, 2026 | Oct 1, 2026 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 2, 2026 | Oct 1, 2026 |
| Debian | — | Upgrade apache2 | Oct 20, 2026 | Oct 1, 2026 |
| Freebsd | — | Upgrade apache24 | Oct 5, 2026 | Oct 1, 2026 |
| Oracle_linux | — | Upgrade mod_ldapUpgrade httpd-filesystemUpgrade httpd-develUpgrade mod_luaUpgrade mod_sessionUpgrade httpdUpgrade httpd-manualUpgrade httpd-toolsUpgrade httpd-coreUpgrade mod_proxy_htmlUpgrade mod_ssl | Oct 28, 2026 | Oct 1, 2026 |
| Redhat_linux | — | Upgrade mod_ldapUpgrade mod_proxy_htmlUpgrade httpd-core-debuginfoUpgrade mod_session-debuginfoUpgrade mod_sessionUpgrade mod_ssl-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade mod_ldap-debuginfoUpgrade httpd-filesystemUpgrade mod_luaUpgrade httpd-debugsourceUpgrade mod_lua-debuginfoUpgrade httpd-develUpgrade httpd-debuginfoUpgrade httpd-manualUpgrade httpd-toolsUpgrade httpd-tools-debuginfoUpgrade httpd-coreUpgrade httpdUpgrade mod_sslNo solution exists | Oct 5, 2026 | Oct 1, 2026 |
| Rocky_linux | — | Upgrade httpd-debugsourceUpgrade mod_ldap-debuginfoUpgrade mod_proxy_htmlUpgrade mod_proxy_html-debuginfoUpgrade mod_lua-debuginfoUpgrade mod_ldapUpgrade mod_session-debuginfoUpgrade mod_sessionUpgrade httpd-debuginfoUpgrade mod_sslUpgrade httpdUpgrade httpd-tools-debuginfoUpgrade httpd-coreUpgrade httpd-toolsUpgrade mod_ssl-debuginfoUpgrade httpd-develUpgrade httpd-core-debuginfoUpgrade mod_lua | Oct 26, 2026 | Oct 23, 2026 |
| Ubuntu | — | Upgrade apache2-mpm-prefork (Ubuntu Pro)Upgrade apache2Upgrade apache2-suexec (Ubuntu Pro)Upgrade libapache2-mod-md (Ubuntu Pro)Upgrade apache2-utilsUpgrade apache2-mpm-worker (Ubuntu Pro)Upgrade apache2-suexec-custom (Ubuntu Pro)Upgrade apache2-ssl-devUpgrade apache2-suexec-pristineUpgrade libapache2-mod-macro (Ubuntu Pro)Upgrade apache2 (Ubuntu Pro)Upgrade apache2-dev (Ubuntu Pro)Upgrade libapache2-mod-proxy-uwsgi (Ubuntu Pro)Upgrade apache2-mpm-event (Ubuntu Pro)Upgrade apache2-utils (Ubuntu Pro)Upgrade apache2-devUpgrade apache2-suexec-pristine (Ubuntu Pro)Upgrade libapache2-mod-proxy-html (Ubuntu Pro)Upgrade libapache2-mod-mdUpgrade apache2-bin (Ubuntu Pro)Upgrade apache2-suexec-customUpgrade apache2-mpm-itk (Ubuntu Pro)Upgrade libapache2-mod-proxy-uwsgiUpgrade apache2-binUpgrade apache2.2-bin (Ubuntu Pro)Upgrade apache2-ssl-dev (Ubuntu Pro) | Oct 15, 2026 | Oct 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub