This vulnerability involves a timing attack against the mod_auth_digest authentication module in Apache HTTP Server 2.4.66. By measuring timing differences, an attacker can bypass Digest authentication, potentially gaining unauthorized access. The issue is identified as CWE-208 (Observable Timing Discrepancy). The vendor has released version 2.4.67 which fixes the vulnerability, although no explicit patch link or detailed remediation level is provided in the available data.

Successful exploitation allows an attacker to bypass Digest authentication, potentially granting unauthorized access to protected resources on the affected Apache HTTP Server. This could lead to unauthorized information disclosure or access control bypass depending on server configuration.

Users are recommended to upgrade Apache HTTP Server to version 2.4.67, which addresses this timing attack vulnerability. Since the vendor advisory indicates an upgrade path, applying this official fix is the primary mitigation. Patch status is not explicitly confirmed beyond the upgrade recommendation, so users should verify the vendor advisory for the latest remediation details.