Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-10-01T16:01:35 httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-303

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.

A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.

To mitigate this issue, disable nonce-count verification by setting `AuthDigestNcCheck Off` within the relevant configuration context in `/etc/httpd/conf/httpd.conf` or `/etc/httpd/conf.d/`: AuthDigestNcCheck Off Alternatively, if Digest authentication is not required, disable `mod_auth_digest` by commenting out the corresponding `LoadModule auth_digest_module` line in `/etc/httpd/conf.modules.d/00-base.conf`. After modifying the configuration, reload the service: systemctl reload httpd Caveats: Disabling `AuthDigestNcCheck` removes server-side nonce-count checking, reducing replay protection for Digest authentication. Warning: Reloading the httpd service can momentarily disrupt in-flight connections. Red Hat Enterprise Linux 10 2026-10-26T00:00:00Z RHSA-2026:89860 httpd-0:2.4.63-13.el10_2.8 Red Hat Enterprise Linux 8 2026-10-29T00:00:00Z RHSA-2026:92616 httpd:2.4-8100020261015114644.489197e6 Red Hat Enterprise Linux 9 2026-10-22T00:00:00Z RHSA-2026:88229 httpd-0:2.4.62-13.el9_8.9 Red Hat Hardened Images 2026-10-02T00:00:00Z RHSA-2026:74858 httpd-main-2.4.69-1.hum1 Red Hat Enterprise Linux 6 Not affected httpd Red Hat Enterprise Linux 7 Affected httpd Red Hat JBoss Core Services Fix deferred jbcs-httpd24-httpd https://www.cve.org/CVERecord?id=CVE-2026-48005 https://nvd.nist.gov/vuln/detail/CVE-2026-48005 http://www.openwall.com/lists/oss-security/2026/10/01/15 https://httpd.apache.org/security/vulnerabilities_24.html