CVE-2026-33006

Опубликовано: 04 мая 2026

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.

Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Ссылки

https://httpd.apache.org/security/vulnerabilities_24.html
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/04/21
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия до 2.4.67 (исключая)

EPSS

Процентиль: 42%

0.00557

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-208

Связанные уязвимости

CVE-2026-33006

CVSS3: 4.8

ubuntu

3 месяца назад

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

CVE-2026-33006

CVSS3: 4.8

redhat

3 месяца назад

CVE-2026-33006

CVSS3: 4.8

msrc

3 месяца назад

Apache HTTP Server: mod_auth_digest timing attack

CVE-2026-33006

CVSS3: 4.8

debian

3 месяца назад

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 a ...

GHSA-r3x7-65m7-5p92

CVSS3: 4.8

github

3 месяца назад

EPSS

Процентиль: 42%

0.00557

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-208