ALPINE-CVE-2026-73636
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
ALPINE-CVE-2026-73636
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-73636
apache2
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.69-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
apache2
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.69-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
apache2
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.69-r0
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
apache2
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.69-r0
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.69-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-73636.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.69-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-73636.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.69-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-73636.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.69-r0"
}
]
}
],
"package": {
"name": "apache2",
"purl": "pkg:apk/alpine/apache2?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-73636.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-73636
Source reference:
/upstream
Publisher severity
high
Source reference: /severity/0/score
- Event
- #72947 · Revision 1
- Added to Heist Feed
- Publisher date