CVE-2026-48005: Apache HTTP Server DoS Vulnerability

CVE-2026-48005 Overview

CVE-2026-48005 is a missing authentication check [CWE-306] in the mod_auth_digest module of Apache HTTP Server versions prior to 2.4.69. The flaw allows an unauthenticated remote client to trigger forced re-authentication by submitting forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck. The condition produces a denial of service against protected resources. The Apache Software Foundation addressed the issue in Apache HTTP Server 2.4.69.

Critical Impact
Unauthenticated attackers can remotely degrade or disrupt availability of Digest-authenticated endpoints by invalidating nonce state and forcing continuous re-authentication cycles.

Affected Products

Apache HTTP Server versions prior to 2.4.69
Deployments with mod_auth_digest enabled
Configurations using AuthDigestNcCheck for nonce-count validation

Discovery Timeline

2026-10-01 - CVE-2026-48005 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-48005

Vulnerability Analysis

The vulnerability resides in the Digest authentication handler provided by mod_auth_digest. When AuthDigestNcCheck is enabled, the module tracks nonce-count (nc) values to prevent replay of previously used Digest credentials. The module fails to properly validate the authenticity of incoming Authorization headers before updating or invalidating nonce state. An attacker can submit crafted Digest Authorization headers that reference legitimate nonces without presenting valid credentials. The server treats these forged submissions as events that corrupt the nonce-count tracking, forcing legitimate clients to perform full re-authentication. Repeated requests sustain the condition and deny access to protected resources.

Root Cause

The root cause is a missing authentication check [CWE-306] in the nonce-count validation path. The module updates stateful tracking data based on client-supplied Authorization header contents without first verifying that the request carries valid credentials. This design permits unauthenticated input to influence authentication state used by other sessions.

Attack Vector

Exploitation requires only network access to a vulnerable Apache HTTP Server instance that exposes a resource protected by Digest authentication with AuthDigestNcCheck active. The attacker sends HTTP requests containing forged Authorization: Digest headers that reference observed or guessable nonce values. No authentication, user interaction, or elevated privileges are required. The impact is limited to availability of the Digest-protected resource.

No verified public exploit code is available. See the Apache HTTP Server Vulnerabilities advisory and the Openwall OSS-Security disclosure for additional technical context.

Detection Methods for CVE-2026-48005

Indicators of Compromise

Spikes in HTTP 401 responses from endpoints protected by Digest authentication
Repeated Authorization: Digest requests from the same source IP referencing varied nc values
Legitimate users reporting unexpected re-authentication prompts on previously stable sessions
Error log entries from mod_auth_digest referencing nonce-count mismatches

Detection Strategies

Correlate access_log and error_log entries for sustained 401 responses tied to specific AuthName realms
Baseline normal Digest authentication rates per realm and alert on deviations
Inspect inbound Authorization headers at a reverse proxy or WAF for malformed Digest parameters

Monitoring Recommendations

Forward Apache access and error logs to a centralized analytics platform for continuous review
Alert on high-volume 401 patterns against Digest-protected URIs from unauthenticated sources
Track mod_auth_digest nonce-related warnings in near real time to identify abuse early

How to Mitigate CVE-2026-48005

Immediate Actions Required

Upgrade Apache HTTP Server to version 2.4.69 or later on all affected hosts
Inventory virtual hosts and .htaccess files to identify every location using AuthType Digest
Restrict network exposure of Digest-protected endpoints to trusted sources until patched
Monitor error logs for abnormal re-authentication activity during the remediation window

Patch Information

The Apache Software Foundation fixed CVE-2026-48005 in Apache HTTP Server 2.4.69. Administrators should upgrade through the operating system package manager or by rebuilding from the official source distribution. Verify the installed version with httpd -v after upgrading. Refer to the Apache HTTP Server 2.4 security advisory for release details.

Workarounds

Disable AuthDigestNcCheck in affected virtual hosts until the upgrade is applied
Replace Digest authentication with Basic authentication over TLS where feasible
Place a reverse proxy or WAF in front of Apache to filter malformed Authorization: Digest headers
Rate-limit requests to Digest-protected URIs from unauthenticated sources

bash

# Configuration example: disable nonce-count checking as a temporary workaround
<Location /protected>
    AuthType Digest
    AuthName "Restricted"
    AuthDigestProvider file
    AuthUserFile /etc/httpd/digest.passwd
    # AuthDigestNcCheck On   # disable until upgraded to 2.4.69+
    Require valid-user
</Location>

# Verify installed version after patching
httpd -v