CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack
Apache httpd before 2.4.69 lets remote clients force Digest re-authentication, CVE-2026-48005.
CVE-2026-48005 affects Apache HTTP Server 2.4.0 through 2.4.68 on all platforms. Missing checks in mod_auth_digest let an unauthenticated remote client force re-authentication, causing denial of service, with forged Authorization headers when Digest authentication and AuthDigestNcCheck are enabled. Apache rates the issue low and recommends upgrading to 2.4.69. The disclosure does not report exploitation in the wild.
- Affects Apache HTTP Server 2.4.0 through 2.4.68.
- Forged Authorization headers force Digest re-authentication.
- Requires Digest auth with AuthDigestNcCheck enabled.
- Fixed in 2.4.69; Apache rates it low.
Vulnerabilities mentionedAll →
- CVE-2026-480057.5—Forced re-auth DoS in Apache HTTP Server mod_auth_digestpublished · Apache Software Foundation Apache HTTP Server
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-48005 | Forced re-auth DoS in Apache HTTP Server mod_auth_digest Apache HTTP Server before 2.4.69 is missing authentication checks in mod_auth_digest. An unauthenticated remote client can send forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck and force repeated re-authentication, causing a denial of service. The issue affects the server on all platforms only in that configuration; it does not by itself grant access or code execution. Apache recommends upgrading to 2.4.69, which fixes the flaw. It is not on the CISA KEV list, has no published CVSS score yet, and no public proof-of-concept or in-the-wild exploitation is known. Do: Upgrade Apache HTTP Server to 2.4.69 or later. Until then, disable AuthDigestNcCheck or turn off Digest authentication if it is not required, and review server configs for AuthType Digest combined with AuthDigestNcCheck. |
Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade...
This source does not provide full text. Read it at seclists.org.