CVE-2026-48005
published 2026-10-01CVE-2026-48005: Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.61%
48.3th percentile
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest
vendor_redhat·2026-10-01·CVSS 7.5
CVE-2026-48005 [HIGH] CWE-303 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest
httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) con
GHSA
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (f
ghsa_unreviewed·2026-10-01
CVE-2026-48005 [HIGH] CWE-306 Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (f
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-48005 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest [fedora-all]
bugzilla·2026-10-02·CVSS 7.5
CVE-2026-48005 [HIGH] CVE-2026-48005 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest [fedora-all]
CVE-2026-48005 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Bugzilla
CVE-2026-48005 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest
bugzilla·2026-10-01·CVSS 7.5
CVE-2026-48005 [HIGH] CVE-2026-48005 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest
CVE-2026-48005 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
2026-10-01
Published