CVE-2026-48005

Summary

The flaw allows unauthenticated attackers to trigger forced re-authentication in Apache HTTP Server's Digest authentication mechanism, leading to denial of service. This occurs when AuthDigestNcCheck is enabled, making the server vulnerable to forged Authorization headers that cause unnecessary authentication cycles.

Exploitability

Exploitation is straightforward as attackers only need to send forged Authorization headers with Digest authentication enabled, requiring no prior authentication or special privileges.

Blast radius

The impact could affect all users of Digest-authenticated services, potentially causing widespread authentication failures and service disruption for legitimate users attempting to access protected resources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache HTTP Server version 2.4.69 which fixes this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.