CVE-2026-48005

Apache HTTP Server: mod_auth_digest reauthentication attack

high · 7.5

Published Oct 1, 2026, 16:01 UTC

Description

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.