CVE-2026-33006: Apache HTTP Server

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

Affected products

• Apache HTTP Server: before 2.4.67 (fixed in 2.4.67)

Published 2026-05-04. Last modified 2026-06-17.