Denial of Service Vulnerability in Apache HTTP Server (apache2) - CVE-2026-48005
Summary
DEBIAN-CVE-2026-48005: Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authenticat... Affects apache2 versions 2.4.57-2 – 2.4.69-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely-used open-source web server software that enables users to serve web content over the internet. It is known for its flexibility, power, and extensive feature set, including support for various authentication methods. However, certain configurations, such as Digest authentication, can expose the server to vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2026-48005 arises from missing authentication checks in the mod_auth_digest module of Apache HTTP Server versions prior to 2.4.69. This flaw allows an unauthenticated remote client to exploit the server by sending forged Authorization headers, leading to a denial of service condition through forced re-authentication. The potential ramifications include service disruption and increased load on the server, as legitimate users may be unable to authenticate successfully.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable Digest authentication if it is not essential for their application. This can be done by commenting out or removing the relevant configuration lines in the Apache configuration files that enable Digest authentication.
Conclusion
CVE-2026-48005 represents a significant security risk for users of Apache HTTP Server versions prior to 2.4.69, allowing for potential denial of service attacks. Upgrading to the patched version is crucial to maintaining the security and availability of web services.
See every vulnerability recorded for apache2 →
FAQ
CVE-2026-48005 is a vulnerability in the Apache HTTP Server that allows unauthenticated remote clients to cause a denial of service through forged Authorization headers.
Apache HTTP Server versions prior to 2.4.69 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2026-48005 is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, consider disabling Digest authentication as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
