CVE-2026-48005

A flaw was found in the mod_auth_digest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of Service (DoS) condition by disrupting valid sessions and repeatedly forcing legitimate users to re-authenticate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable nonce-count verification by setting AuthDigestNcCheck Off within the relevant configuration context in /etc/httpd/conf/httpd.conf or /etc/httpd/conf.d/:

AuthDigestNcCheck Off

Alternatively, if Digest authentication is not required, disable mod_auth_digest by commenting out the corresponding LoadModule auth_digest_module line in /etc/httpd/conf.modules.d/00-base.conf.

After modifying the configuration, reload the service:

systemctl reload httpd

Caveats: Disabling AuthDigestNcCheck removes server-side nonce-count checking, reducing replay protection for Digest authentication.

Warning: Reloading the httpd service can momentarily disrupt in-flight connections.