Medium severity4.8NVD Advisory· Published May 4, 2026· Updated May 4, 2026
CVE-2026-33006
CVE-2026-33006
Description
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.
Users are recommended to upgrade to version 2.4.67, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
18cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*range: <2.4.67
- (no CPE)range: <=2.4.66
- osv-coords16 versionspkg:bitnami/apachepkg:rpm/opensuse/apache2&distro=openSUSE%20Tumbleweedpkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.4.67+ 15 more
- (no CPE)range: < 2.4.67
- (no CPE)range: < 2.4.67-1.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
- (no CPE)range: < 2.4.66-160000.2.1
Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2026/05/04/21nvdMailing ListThird Party Advisory
- httpd.apache.org/security/vulnerabilities_24.htmlnvdVendor Advisory
News mentions
3- Debian 13.5 point release lands with security fixes, bug patchesHelp Net Security · May 17, 2026
- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026
- Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP ServerSecurityWeek · May 5, 2026