CVE-2026-33006
Publication date 5 May 2026
Last updated 6 August 2026
Ubuntu priority
Description
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Read the notes from the security team
Why is this CVE low priority?
Apache httpd developers have rated this to be a low-severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| apache2 | 26.04 LTS resolute |
Fixed 2.4.66-2ubuntu2.1
|
| 24.04 LTS noble |
Fixed 2.4.58-1ubuntu8.12
|
|
| 22.04 LTS jammy |
Fixed 2.4.52-1ubuntu4.20
|
|
| 20.04 LTS focal |
Fixed 2.4.41-4ubuntu3.23+esm6
|
|
| 18.04 LTS bionic |
Fixed 2.4.29-1ubuntu4.27+esm11
|
|
| 16.04 LTS xenial |
Fixed 2.4.18-2ubuntu3.17+esm20
|
|
| 14.04 LTS trusty |
Fixed 2.4.7-1ubuntu4.22+esm15
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
Severity score breakdown
CVSS version: CVSS v3.0
Base score
4.8 · Medium
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8239-1
- Apache HTTP Server vulnerabilities
- 6 May 2026
- USN-8589-1
- Apache HTTP Server vulnerabilities
- 22 July 2026