Описание
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.
Меры по смягчению последствий
To mitigate this issue, disable nonce-count verification by setting AuthDigestNcCheck Off within the relevant configuration context in /etc/httpd/conf/httpd.conf or /etc/httpd/conf.d/:
AuthDigestNcCheck Off
Alternatively, if Digest authentication is not required, disable mod_auth_digest by commenting out the corresponding LoadModule auth_digest_module line in /etc/httpd/conf.modules.d/00-base.conf.
After modifying the configuration, reload the service:
systemctl reload httpd
Caveats: Disabling AuthDigestNcCheck removes server-side nonce-count checking, reducing replay protection for Digest authentication.
Warning: Reloading the httpd service can momentarily disrupt in-flight connections.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | httpd | Fix deferred | ||
| Red Hat Enterprise Linux 6 | httpd | Not affected | ||
| Red Hat Enterprise Linux 7 | httpd | Affected | ||
| Red Hat Enterprise Linux 8 | httpd:2.4/httpd | Affected | ||
| Red Hat JBoss Core Services | jbcs-httpd24-httpd | Fix deferred | ||
| Red Hat Enterprise Linux 9 | httpd | Fixed | RHSA-2026:88229 | 22.10.2026 |
| Red Hat Hardened Images | httpd-main-2.4.69-1.hum1 | Fixed | RHSA-2026:74858 | 02.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Apache HTTP Server: mod_auth_digest reauthentication attack
Missing authentication checks in mod_auth_digest in Apache Software Fo ...
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.
EPSS
3.7 Low
CVSS3