CVE-2026-33006

published 2026-05-04

CVE-2026-33006: A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to…

medium 4.8 CVSS 3.1

AV N AC H PR N UI N S U C L I L A N

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	< 2.4.67	2.4.67
apache	httpd	—	—
apache_software_foundation	apache_http_server	<= 2.4.66	—
httpd_2.4	httpd	—	—
ubuntu	apache2	—	—

CWE-208