CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – VoIP SIP ダイジェスト認証リプレイ プログラムコード（Python SIP シミュレータ） sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set @app.route'/call', methods='POST' def...

CVE-2026-48005

A flaw was found in the modauthdigest module of the Apache HTTP Server. When Digest authentication is configured with nonce-count checking enabled, missing authentication checks allow an unauthenticated remote attacker to submit forged HTTP Authorization headers. This flaw can lead to a Denial of...

DEBIAN-CVE-2026-73637

Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifeti...

CTT-enhanced-Apache-mod_auth_digest-timing-attack-exploit

CTT增强版Apache modauthdigest时序攻击 — CVE-2026-33006 🔥 概述 这是对CVE-2026-33006的收敛时间理论（CTT）增强，该漏洞是Apache HTTP Server modauthdigest组件（版本≤2.4.66）中基于时序的漏洞。 原始漏洞允许远程攻击者通过统计时序分析绕过Digest认证。 CTT增强版将其转变为33层时间级联时序攻击。 | 原始版本| CTT增强版 ---|---|--- CVSS| 4.8（中危）| 7.5（高危） 攻击向量| 网络| 网络 攻击复杂度| 高| 低（CTT减少采样次数） 所需权限| 无| 无...

CVE-2026-48005

The Apache Software Foundation Apache HTTP Server (versions before 2.4.69 ) on all platforms is vulnerable to a denial of service (forced re-authentication) via a missing authentication check in mod_auth_digest . An unauthenticated remote client can trigger this by sending forged Authorization he...

cve-2026-43512-poc

CVE-2026-43512 — Apache Tomcat DIGEST認証バイパス エクスプロイト可能性分析結果: 根本原因は確認されました。標準のUserDatabaseRealmデプロイメントに対するエンドツーエンドのエクスプロイトは再現できません 。詳細は分析を参照。 目次 概要 影響を受けるバージョン 根本原因 分析 リポジトリ構成 要件 使用方法 期待される出力 参考 免責事項 概要 CVE-2026-43512は、Apache TomcatのHTTP...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2023_6267)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236267 advisory. SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication CVE-2023-46847 SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP...

PT-2026-103926

Missing authentication checks in mod auth digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled wit...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.6:CLSA-2026:1783703539)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783703539 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.6:CLSA-2026:1783703539)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783703539 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2026:1783705168)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783705168 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1783942033)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1783942033 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origi...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779957268)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779957268 advisory. - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7...

Moderate: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2026-3930)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3930 advisory. A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while...

RHEL 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 (RHSA-2026:73076)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73076 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...

PoC_CVE-2019-0217

このリポジトリには、CVE-2019-0217 の概念実証エクスプロイトと、この CVE に対して脆弱な Web サーバーをセットアップするための Dockerfile が含まれています。 CVE の説明 Apache HTTP Server 2.4 リリース 2.4.38 以前において、スレッドサーバー上で実行されている場合の modauthdigest の競合状態により、有効な認証情報を持つユーザーが別のユーザー名を使用して認証し、設定されたアクセス制御の制限を迂回できる可能性があります。 背景 HTTP ダイジェスト認証 クライアントが HTTP...

curl: curl: Information disclosure via incorrect Digest authentication header reuse

A flaw was found in curl. When libcurl performs a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This...

EUVD-2026-88142

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...