CVE-2026-33006

CVSS 3.1: 4.8 medium
EPSS: <1%p45
Published: May 4, 2026 · May 4, 2026
Modified: Oct 26, 2026

Analyze CVE-2026-33006 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Vendors: apache

Products: http server

Weakness: CWE-208

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

1 story

Debian 13.5 point release lands with security fixes, bug patches

Help Net SecurityMay 18, 00:00 UTC · May 18, 2026VulnerabilityCVE-2026-23918 CVE-2026-24072 CVE-2026-33006+144 · 1 read