What is GHSA-gr5c-77fq-wx32?

GHSA-gr5c-77fq-wx32 is a security advisory published by GitHub Security Advisories with High severity. Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69...

Which CVE IDs does GHSA-gr5c-77fq-wx32 cover?

GHSA-gr5c-77fq-wx32 covers the following CVE IDs: CVE-2026-73637. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gr5c-77fq-wx32?

GHSA-gr5c-77fq-wx32 has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

GHSA-gr5c-77fq-wx32HighCVSS 7.3

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-73637 →

📋 Description

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-73637
https://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2026/10/01/28
https://github.com/advisories/GHSA-gr5c-77fq-wx32