CVE-2026-33006

4.8 medium exploit SSVC exploitation: none Analyzed

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Fix

Public exploits 1

SimoesCTT/CTT-enhanced-Apache-mod_auth_digest-timing-attack-exploit PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-26 19:33First seenCVSS 4.8 · apacheNVD modified 2026-10-26 19:10

Affected (CPE criteria) 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

References 2

https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/04/21 Mailing List, Third Party Advisory