CVE-2026-33006: Apache HTTP Server: mod_auth_digest timing attack
A timing attack against modauthdigest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.
Other sources
Apache HTTP Server: modauthdigest timing attack
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.67-1~deb11u3Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.67-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.67Patch CVE-2026-33006
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33006?
CVE-2026-33006 is rated as a high-severity vulnerability due to its potential for unauthorized authentication bypass.
How do I fix CVE-2026-33006?
To fix CVE-2026-33006, upgrade Apache HTTP Server from version 2.4.66 to version 2.4.67.
What vulnerability does CVE-2026-33006 address?
CVE-2026-33006 addresses a timing attack vulnerability in mod_auth_digest that allows remote attackers to bypass Digest authentication.
Which versions of Apache HTTP Server are affected by CVE-2026-33006?
Apache HTTP Server version 2.4.66 is the only version affected by CVE-2026-33006.
Can CVE-2026-33006 be exploited remotely?
Yes, CVE-2026-33006 can be exploited remotely, allowing attackers to bypass authentication through a timing attack.