CVE-2020-35452: mod_auth_digest possible stack overflow by one nul byte

Security readout for executives and security teams

CVE-2020-35452 affects Apache HTTP Server 2.4.0 through 2.4.46. A specially crafted Digest authentication nonce can trigger a one-byte stack overflow in mod_auth_digest. Apache reported no known exploitable overflow and could not create one, so business urgency is mainly patch hygiene for exposed web servers. Exposure is most likely on Apache HTTP Server 2.4.0-2.4.46 systems where mod_auth_digest is enabled, especially internet-facing or authentication-protected sites using Digest authentication. Systems not running Apache httpd or not loading this module are less likely exposed. Handle through normal web-server patch management, with priority for exposed Apache systems using Digest authentication. The evidence does not support emergency incident response, but unsupported or unpatched Apache deployments should be remediated promptly. Mitigation focus: Apply Apache HTTP Server or OS vendor security updates for this CVE.; Confirm deployed httpd versions are outside the affected 2.4.0-2.4.46 range.; Review whether mod_auth_digest is enabled and needed in production..

Prepared

Jun 2, 2026, 19:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.