CVE-2026-33006

MEDIUM 4.8CVE-2026-33006 · Published 04/05/2026 · updated 26/10/2026

In short

CVE-2026-33006 is a MEDIUM (CVSS 4.8) vulnerability affecting http server (apache).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.5% of all vulnerabilities.
Fix: update to 2.4.67 or later.

Package	Affected versions	Patched versions
http server apache	`< 2.4.67`	`2.4.67`

Description

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

References

httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
openwall.com/lists/oss-security/2026/05/04/21 · Mailing List

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

http server

apache

< 2.4.67

2.4.67

More vulnerabilities in http server

See all →