CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack
Apache HTTP Server: modauthdigest reauthentication attack
Other sources
Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.69-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache HTTP Server deployments before 2.4.69 are affected when Digest authentication is enabled and the AuthDigestNcCheck setting is in use. The issue applies on all platforms.
What does an attacker need to exploit it?
An unauthenticated remote client can send forged Authorization headers. No valid credentials are required to trigger the forced re-authentication condition.
What is the impact of exploitation?
An attacker can cause a denial of service by forcing users to re-authenticate. The provided information does not describe impacts beyond forced re-authentication.
What should teams do to remediate the issue?
Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.