High RHSA-2025:14997 2 CVEs

Red Hat Security Advisory: httpd security update

Published Sep 2, 2025 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 9

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	httpd	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	httpd-debuginfo	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	httpd-devel	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	httpd-manual	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	httpd-tools	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	mod_ldap	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	mod_proxy_html	1:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	mod_session	0:2.4.6-99.el7_9.6
Red Hat · RHEL 7 ELS rhel_els:7	mod_ssl	1:2.4.6-99.el7_9.6

Vulnerabilities 2

High 7.5

CVE-2024-47252

Apache HTTP Server: mod_ssl error log variable escaping

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Jul 10, 2025
High 7.4

CVE-2025-49812 Public exploit

Apache HTTP Server: mod_ssl TLS upgrade attack

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Jul 10, 2025

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2374571
report
https://bugzilla.redhat.com/show_bug.cgi?id=2374580
article
https://issues.redhat.com/browse/RHEL-6588
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14997.json
report
https://access.redhat.com/security/cve/CVE-2024-47252
advisory
https://www.cve.org/CVERecord?id=CVE-2024-47252
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-47252
article
https://httpd.apache.org/security/vulnerabilities_24.html
report
https://access.redhat.com/security/cve/CVE-2025-49812
advisory
https://www.cve.org/CVERecord?id=CVE-2025-49812
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-49812