UBUNTU-CVE-2026-48005: High severity ubuntu/apache2 vulnerability

Published Oct 1, 2026

Updated

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

8 affected components

ubuntu/apache2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed?

Deployments using mod_auth_digest with Digest authentication enabled and AuthDigestNcCheck configured are affected if they run Apache HTTP Server before 2.4.69. The issue applies on all platforms.

What does an attacker need to exploit this issue?

An unauthenticated remote client can trigger the issue by sending forged Authorization headers. No privileges or user interaction are required.

What is the impact of exploitation?

An attacker can cause denial of service by forcing users to re-authenticate. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.

What should be done if the affected configuration is in use?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue.

UBUNTU-CVE-2026-48005: High severity ubuntu/apache2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of exploitation?

What should be done if the affected configuration is in use?

Company

Resources

Contact

Frequently Asked Questions

Which Apache HTTP Server deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of exploitation?

What should be done if the affected configuration is in use?