CVE-2026-48005·Apache vulnerability

Affected versions

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.69 or later to patch the authentication bypass vulnerability in mod_auth_digest. This update eliminates the weakness that allows attackers to forge digest authentication headers and trigger service disruption. If you are currently running versions 2.4.0 through 2.4.68 with Digest authentication enabled, immediate patching is recommended to restore proper authentication validation.

sudo dnf update httpd httpd-tools

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /.*HTTP.*Authorization:.*Digest.*nc=([0-9a-fA-F]+).*qop=auth|Multiple 401 responses to same endpoint from same source IP within 60 seconds|Authorization header with mismatched nonce value in repeated requests

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement a WAF rule to rate-limit or block requests from single IPs sending multiple Authorization headers with varying digest values within a short timeframe. Alternatively, block requests with malformed or duplicate Digest authentication parameters.

How to check if you are affected

1. Check Apache version: apache2ctl -v or httpd -v — confirm installed version is 2.4.68 or earlier
2. Verify Digest authentication is enabled: grep -i 'AuthDigestNcCheck' /etc/apache2/mods-enabled/*.conf or /etc/httpd/conf.d/*.conf
3. Search access and error logs for repeated 401 responses from single IP: grep '401' /var/log/apache2/access.log | cut -d' ' -f1 | sort | uniq -c | sort -rn
4. Confirm patch applied: apache2ctl -v or httpd -v should show 2.4.69 or later after upgrade completion

FAQ

Related Apache CVEs

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2026/10/01/15