CVE-2026-48005

Apache HTTP Server before 2.4.69 is missing authentication checks in mod_auth_digest. An unauthenticated remote client can send forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck and force repeated re-authentication, causing a denial of service. The issue affects the server on all platforms only in that configuration; it does not by itself grant access or code execution. Apache recommends upgrading to 2.4.69, which fixes the flaw. It is not on the CISA KEV list, has no published CVSS score yet, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, disable AuthDigestNcCheck or turn off Digest authentication if it is not required, and review server configs for AuthType Digest combined with AuthDigestNcCheck.