Vulnerability-Lookup

RHSA-2025:15023

Vulnerability from csaf_opensuse - Published: 2025-09-02 00:00 - Updated: 2026-09-20 11:48

Summary

security update for httpd

Severity

Moderate

Notes

Title of the patch: security update for httpd

Description of the patch: This security update provides a functional equivalent of RHSA-2025:15023. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:15023.

Patchnames: RHSA-2025:15023

CVE-2024-47252

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 11 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2025-23048

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 11 products, the same list as for CVE-2024-47252

Threats

Impact important

CVE-2025-49812

7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Affected products

Recommended 11 products, the same list as for CVE-2024-47252

Threats

Impact important

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-47252/	self
https://www.suse.com/security/cve/CVE-2025-23048/	self
https://www.suse.com/security/cve/CVE-2025-49812/	self
https://www.suse.com/security/cve/CVE-2024-47252	external
https://bugzilla.suse.com/1246303	external
https://bugzilla.suse.com/1261312	external
https://www.suse.com/security/cve/CVE-2025-23048	external
https://bugzilla.suse.com/1246302	external
https://bugzilla.suse.com/1261312	external
https://www.suse.com/security/cve/CVE-2025-49812	external
https://bugzilla.suse.com/1246161	external
https://bugzilla.suse.com/1261312	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for httpd",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2025:15023.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2025:15023.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2025:15023",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_15023.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2025:15023",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-September/001973.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2025:15023",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2025-September/001973.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47252 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47252/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23048 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23048/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-49812 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-49812/"
      }
    ],
    "title": "security update for httpd",
    "tracking": {
      "current_release_date": "2026-09-20T11:48:38Z",
      "generator": {
        "date": "2025-09-02T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2025:15023",
      "initial_release_date": "2025-09-02T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-09-02T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:48:38Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
                "product": {
                  "name": "httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
                  "product_id": "httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-filesystem@2.4.62-4.el9_6.4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-manual-0:2.4.62-4.el9_6.4.noarch",
                "product": {
                  "name": "httpd-manual-0:2.4.62-4.el9_6.4.noarch",
                  "product_id": "httpd-manual-0:2.4.62-4.el9_6.4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-manual@2.4.62-4.el9_6.4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "httpd-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "httpd-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-core-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "httpd-core-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "httpd-core-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-core@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-devel@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-tools@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_ldap@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_lua-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "mod_lua-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "mod_lua-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_lua@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_proxy_html@2.4.62-4.el9_6.4?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "mod_session-0:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "mod_session-0:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_session@2.4.62-4.el9_6.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.62-4.el9_6.4.x86_64",
                "product": {
                  "name": "mod_ssl-1:2.4.62-4.el9_6.4.x86_64",
                  "product_id": "mod_ssl-1:2.4.62-4.el9_6.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_ssl@2.4.62-4.el9_6.4?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "httpd-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-core-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "httpd-core-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-filesystem-0:2.4.62-4.el9_6.4.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch"
        },
        "product_reference": "httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-manual-0:2.4.62-4.el9_6.4.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch"
        },
        "product_reference": "httpd-manual-0:2.4.62-4.el9_6.4.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_lua-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "mod_lua-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "mod_session-0:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.62-4.el9_6.4.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
        },
        "product_reference": "mod_ssl-1:2.4.62-4.el9_6.4.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-47252",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47252"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \"%{varname}x\" or \"%{varname}c\" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
          "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
          "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47252",
          "url": "https://www.suse.com/security/cve/CVE-2024-47252"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246303 for CVE-2024-47252",
          "url": "https://bugzilla.suse.com/1246303"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261312 for CVE-2024-47252",
          "url": "https://bugzilla.suse.com/1261312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-47252"
    },
    {
      "cve": "CVE-2025-23048",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23048"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
          "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
          "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23048",
          "url": "https://www.suse.com/security/cve/CVE-2025-23048"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246302 for CVE-2025-23048",
          "url": "https://bugzilla.suse.com/1246302"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261312 for CVE-2025-23048",
          "url": "https://bugzilla.suse.com/1261312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-23048"
    },
    {
      "cve": "CVE-2025-49812",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-49812"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \"SSLEngine optional\" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
          "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
          "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
          "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-49812",
          "url": "https://www.suse.com/security/cve/CVE-2025-49812"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246161 for CVE-2025-49812",
          "url": "https://bugzilla.suse.com/1246161"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261312 for CVE-2025-49812",
          "url": "https://bugzilla.suse.com/1261312"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:httpd-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-core-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-devel-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:httpd-filesystem-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-manual-0:2.4.62-4.el9_6.4.noarch",
            "SUSE Liberty Linux 9:httpd-tools-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ldap-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_lua-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_session-0:2.4.62-4.el9_6.4.x86_64",
            "SUSE Liberty Linux 9:mod_ssl-1:2.4.62-4.el9_6.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-49812"
    }
  ]
}

CVE-2024-47252 (GCVE-0-2024-47252)

Vulnerability from cvelistv5 – Published: 2025-07-10 16:55 – Updated: 2025-11-04 21:08

Title

Apache HTTP Server: mod_ssl error log variable escaping

Summary

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-11 16:06 UTC

CWE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

apache mitre root

References

4 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/10/2
http://www.openwall.com/lists/oss-security/2025/07/10/6

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4 , ≤ 2.4.63 (semver)

Credits

John Runyon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47252",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-11T16:06:33.872531Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-15T19:56:38.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:08:59.176Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.63",
              "status": "affected",
              "version": "2.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Runyon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\u003cbr\u003e\u003cbr\u003eIn a logging configuration where CustomLog is used with \"%{varname}x\" or \"%{varname}c\" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with \"%{varname}x\" or \"%{varname}c\" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:55:20.013Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-18T15:26:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Apache HTTP Server: mod_ssl error log variable escaping",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-47252",
    "datePublished": "2025-07-10T16:55:20.013Z",
    "dateReserved": "2024-09-23T15:25:33.808Z",
    "dateUpdated": "2025-11-04T21:08:59.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-23048 (GCVE-0-2025-23048)

Vulnerability from cvelistv5 – Published: 2025-07-10 16:56 – Updated: 2026-02-26 17:50

Title

Apache HTTP Server: mod_ssl access control bypass with session resumption

Summary

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-22 04:55 UTC

CWE

CWE-284 - Improper Access Control

Assigner

apache mitre root

References

4 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/10/2
http://www.openwall.com/lists/oss-security/2025/07/10/8

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.35 , ≤ 2.4.63 (semver)

Credits

Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj Somorovsky at Paderborn University

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-23048",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T04:55:52.192669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:50:47.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:09:37.109Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.63",
              "status": "affected",
              "version": "2.4.35",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj Somorovsky at Paderborn University"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\u003cbr\u003e\u003cbr\u003eConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:56:53.545Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-25T15:01:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Apache HTTP Server: mod_ssl access control bypass with session resumption",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-23048",
    "datePublished": "2025-07-10T16:56:53.545Z",
    "dateReserved": "2025-01-10T15:11:45.480Z",
    "dateUpdated": "2026-02-26T17:50:47.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-49812 (GCVE-0-2025-49812)

Vulnerability from cvelistv5 – Published: 2025-07-10 16:58 – Updated: 2025-11-04 21:11

Title

Apache HTTP Server: mod_ssl TLS upgrade attack

Summary

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-11 16:05 UTC

CWE

CWE-287 - Improper Authentication

Assigner

apache mitre root

References

5 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/09/3
http://www.openwall.com/lists/oss-security/2025/07/10/2
http://www.openwall.com/lists/oss-security/2025/07/10/9

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 0 , ≤ 2.4.63 (semver)

Credits

Robert Merget (Technology Innovation Institute) Nurullah Erinola (Ruhr University Bochum) Marcel Maehren (Ruhr University Bochum) Lukas Knittel (Ruhr University Bochum) Sven Hebrok (Paderborn University) Marcus Brinkmann (Ruhr University Bochum) Juraj Somorovsky (Paderborn University) Jörg Schwenk (Ruhr University Bochum)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-49812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-11T16:05:54.218961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-15T19:56:14.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:11:18.699Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/09/3"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/10/9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.63",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Robert Merget (Technology Innovation Institute)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nurullah Erinola (Ruhr University Bochum)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcel Maehren (Ruhr University Bochum)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Lukas Knittel (Ruhr University Bochum)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sven Hebrok (Paderborn University)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcus Brinkmann (Ruhr University Bochum)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Somorovsky (Paderborn University)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "J\u00f6rg Schwenk (Ruhr University Bochum)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\u003cbr\u003e\u003cbr\u003eOnly configurations using \"SSLEngine optional\" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade."
            }
          ],
          "value": "In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using \"SSLEngine optional\" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T16:58:23.943Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-22T07:26:00.000Z",
          "value": "Report received"
        },
        {
          "lang": "en",
          "time": "2025-07-07T00:00:00.000Z",
          "value": "2.4.x revision 1927045"
        }
      ],
      "title": "Apache HTTP Server: mod_ssl TLS upgrade attack",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-49812",
    "datePublished": "2025-07-10T16:58:23.943Z",
    "dateReserved": "2025-06-11T09:36:54.723Z",
    "dateUpdated": "2025-11-04T21:11:18.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:15023

CVE-2024-47252 (GCVE-0-2024-47252)

CVE-2025-23048 (GCVE-0-2025-23048)

CVE-2025-49812 (GCVE-0-2025-49812)

Tags

Sightings

Nomenclature

Related by attack behaviour