{"id":"CVE-2026-48005","published":"2026-10-01T17:17:25.480","lastModified":"2026-10-06T14:07:10.460","description":"Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-306"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/15","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to trigger forced re-authentication in Apache HTTP Server's Digest authentication mechanism, leading to denial of service. This occurs when AuthDigestNcCheck is enabled, making the server vulnerable to forged Authorization headers that cause unnecessary authentication cycles.","exploitability":"Exploitation is straightforward as attackers only need to send forged Authorization headers with Digest authentication enabled, requiring no prior authentication or special privileges.","blast_radius":"The impact could affect all users of Digest-authenticated services, potentially causing widespread authentication failures and service disruption for legitimate users attempting to access protected resources.","remediation":"Upgrade to Apache HTTP Server version 2.4.69 which fixes this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","auth-bypass","web-server"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:50.452Z"}}