Apache HTTP Server auth-state lifecycle: Digest capture-replay, concurrent-request UAF, and h2 session reuse (2.4.0–2.4.68)¶

Source: GitHub advisories published 2026-10-01 against Apache HTTP Server (fixed 2.4.69). Related pages: Sept 21 auth-method precedence page, Aug 26 Tomcat auth/parser batch.

Why this is durable: httpd 2.4.x is deployed behind a huge share of frontiers, and this wave is about authentication state that lives in server memory with a lifecycle — nonces, nonce-counters, shared-memory entries, per-session buffers. Every one of these items gives a black-box testable property: you can detect the vulnerable configuration and prove the boundary from the client side without an exploit.

The four advisories¶

Durable axes¶

1. Digest auth state is a configuration-visible oracle. The vulnerable preconditions (AuthDigestNcCheck On, AuthDigestNonceLifetime 0) are probeable from outside: replay the same nonce with the same nc and watch whether it's accepted (NC check off/weak), reuse a nonce long after issuance (lifetime 0 → stale nonces accepted, which is exactly the replay precondition). Add a Digest-auth probe to any recon pass that sees WWW-Authenticate: Digest: challenge parse → nonce lifetime test → nc-increment test → concurrent-issue test. The replay bypass itself needs a MITM position, so report the probeable configuration (stale nonce + no nc enforcement) as the finding, which is the same precondition set.
2. Concurrency is an auth-state attack, not just a DoS attack. The UAF is reached by concurrent Digest requests corrupting authentication state — an unauthenticated client. The class rule (join: session-cache OTP counters, Keycloak session-restart marker wipe): when auth state is keyed per-client in shared memory and mutated per-request, race the requests. Black-box signal: auth results that flip for the same valid credential under parallel load, or 5xx on / only under concurrent 401-challenge pressure. Prove only "authentication state corruption" (wrong-code accepted / correct-code rejected under race) on authorized targets — the UAF itself is crash territory, lab builds only.
3. Protocol-layer UAF on just-patched builds. The h2 session->bbtmp re-entrancy UAF sits in the version range that has been "current" for years; same lesson as the Tomcat HTTP/2 fix-regression entry: after any httpd mod_http2 CVE cycle, re-run the raw-byte h2 battery against the new build, because shared session buffers are exactly where fixes introduce re-entrancy bugs. Frame h2 memory-safety as reachability evidence (does the server accept malformed stream interleaving at all?), never crash public frontiers.
4. SSLRequire expression gaps = mTLS policy that doesn't apply. File-related expressions in SSLRequire privilege mismanagement means authorization decisions written in mod_ssl expressions can evaluate against the wrong object. Operator rule: whenever a target uses SSLVerifyClient optional + SSLRequire (soft-fail mTLS, the pattern behind this page's Tomcat realm first-wins sibling), test the full decision matrix: no cert / valid cert / revoked-or-foreign cert against each protected location, and diff which locations authorize — the expression-evaluation bug shows up as an unexpected allow on one leg.

Validation boundaries¶

Authorized targets only. Non-invasive proofs first: Digest configuration probing (nonce reuse, nc replay), mTLS decision tables, version banner (Server: header + protocol feature probes). The Digest UAF and h2 UAF are crash/memory-corruption primitives — reproduce only against lab httpd builds you own, with the exact advisory configuration (AuthDigestNcCheck On / AuthDigestNonceLifetime 0), and never fuzz production frontiers with concurrent-state-corruption traffic. Capture the 401-challenge parameters as evidence; never collect real user credentials.

October 1 21:3xZ follow-up: the rest of the wave — module-level primitives (folded)¶

The same 18:32Z advisory train carried a second tier of httpd 2.4.0–2.4.68 module defects that landed in the updated feed at 21:33Z. Same invariant as this page — the module you enabled is a separate implementation with its own parser, buffer, and trust assumptions — but different sinks:

Durable axes from the second tier:

1. Host is a memory-safety input, not just a routing string. The vhost_alias overflow is triggered by the request's own Host header once VirtualDocumentRoot interpolates it. Add an oversized-Host probe (e.g. 9 KB Host) to any httpd recon pass on hosts where LimitRequestFieldSize has been raised — acceptance vs 400/413 vs worker death is a black-box configuration oracle. Prove reachability only; never chase the write.
2. Any module that parses a peer-supplied address opens a pivot. The PASV-reply flaw is the FTP twin of every "server names the connect destination" bug: in forward-proxy configs your outbound destination is chosen by the remote server's payload. If an authorized scope includes an httpd forward proxy with FTP enabled, connect it only to owned servers and record whether a crafted PASV address produces an outbound connection to your listener — that single proof is the finding.
3. Lookahead/rewrite re-entrancy is auth-state lifecycle in a different costume. %{LA-U:...} spawns an internal sub-request that shares request state; same test discipline as the digest race: sub-request-bearing rewrite rules on just-patched builds deserve re-run batteries, and 5xx only-when-a-specific-RulePattern-fires is the reachability signal.
4. Response-side parser differentials exist below HTTP/1.1 framing too. The uwsgi adapter trusts Transfer-Encoding inside the backend response — when a target fronts uwsgi/AJP/FCG variants, run the desync canary battery against the backend protocol, not just the client-facing leg.
5. /./ and .DAV are cheap recon strings. Append /./ segments to userdir-style paths and GET /.DAV/ (or GET <dir>/.DAV/) on any WebDAV-visible route: an equivalence leak or dead-property disclosure is a same-origin, non-invasive first-touch check.

Tracked, not published from the same wave¶

• Zod ≤4.6.5 uncapped array-issue accumulation OOM (CVE-2026-54404) — availability-only validation-library DoS; revisit if an early-termination oracle emerges.
• jackson-dataformats-binary Smile parser never invokes StreamReadConstraints.validateNameLength() (CVE-2026-68496) — constraint-coverage drift class (same shape as the Oct 1 guard-coverage page: the configured limit exists, one code path never calls the validator); no operator sink beyond DoS yet.
• TP-Link TL-WR841N authenticated IPv6-gateway command injection (CVE-2026-102294) — admin-auth router cmdi, single-product, class already covered.