Apache HTTP Server CVE-2026-33006

Upgrade Apache HTTP Server to version 2.4.67 or later, which includes the fix for the mod_auth_digest timing attack. Patch deployment is straightforward: stop the server, replace the binary or rebuild from source with the updated version, and restart. For organizations unable to patch immediately, disable mod_auth_digest (uncomment or remove the LoadModule directive) and migrate to alternative authentication schemes: use mod_auth_basic with TLS-encrypted connections (requires HTTPS), implement OAuth 2.0 via mod_auth_openidc, or restrict Digest authentication to trusted networks via firewall rules or IP whitelisting on the VirtualHost directive. Disabling mod_auth_digest entirely eliminates attack surface but breaks existing Digest-authenticated clients; coordinate with application owners before removal. HTTPS is mandatory if switching to Basic authentication, as Digest's value proposition is avoiding plaintext credential transmission; HTTP Basic over cleartext HTTP would be strictly worse. Monitor vendor advisories at https://httpd.apache.org/security/vulnerabilities_24.html for any cumulative patches.