https://seclists.org/oss-sec/2026/q4/14: CVE-2026-48005: Apache HTTP Server: mod_auth_digest authentication attack

Q: Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_auth_digest is used with Digest authentication enabled and the AuthDigestNcCheck directive configured. The issue applies on all platforms.

Q: What does an attacker need to exploit it, and what is the impact?

An unauthenticated remote client can send forged Authorization headers. Successful exploitation causes a denial of service by forcing users to re-authenticate.

Q: What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the missing authentication checks in mod_auth_digest.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server versions 2.4.0 through 2.4.68 are affected when mod_auth_digest is used with Digest authentication enabled and the AuthDigestNcCheck directive configured. The issue applies on all platforms.

What does an attacker need to exploit it, and what is the impact?

An unauthenticated remote client can send forged Authorization headers. Successful exploitation causes a denial of service by forcing users to re-authenticate.

What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the missing authentication checks in mod_auth_digest.