Timing Att. Mod Auth Digest Bypass in Apache HTTP Server 2.4.66
CVE-2026-33006 Published on May 4, 2026
Apache HTTP Server: mod_auth_digest timing attack
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Vulnerability Analysis
CVE-2026-33006 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Report received
2.4.67 released 56 days later.
fixed in 2.4.x by r1933356
Weakness Type
Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Products Associated with CVE-2026-33006
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-33006 are published in these products:
Affected Versions
Apache Software Foundation Apache HTTP Server:- Before and including 2.4.66 is affected.