Red Hat Security Advisory: httpd:2.4 security update

Fixed packages 44

Vulnerabilities 4

• Critical 9.1
  CVE-2025-23048 Public exploit

  Apache HTTP Server: mod_ssl access control bypass with session resumption

  In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2024-47252

  Apache HTTP Server: mod_ssl error log variable escaping

  Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2025-49630

  Apache HTTP Server: mod_proxy_http2 denial of service

  In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured f…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.4
  CVE-2025-49812 Public exploit

  Apache HTTP Server: mod_ssl TLS upgrade attack

  In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374578
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374580
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15684.json
• report
  https://access.redhat.com/security/cve/CVE-2024-47252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47252
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47252
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2025-23048
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-23048
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-23048
• report
  https://access.redhat.com/security/cve/CVE-2025-49630
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49630
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49630
• report
  https://access.redhat.com/security/cve/CVE-2025-49812
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49812
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49812