Summary
It was discovered that the Apache HTTP Server incorrectly handled certain
Content-Type response headers. A remote attacker could possibly use this
issue to perform HTTP response splitting attacks. (CVE-2024-42516)
xiaojunjie discovered that the Apache HTTP Server mod_proxy module
incorrectly handled certain requests. A remote attacker could possibly use
this issue to send outbound proxy requests to an arbitrary URL.
(CVE-2024-43204)
John Runyon discovered that the Apache HTTP Server mod_ssl module
incorrectly escaped certain data. A remote attacker could possibly use this
issue to insert escape characters into log files. (CVE-2024-47252)
Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj
Somorovsky discovered that the Apache HTTP Server mod_ssl module
incorrectly handled TLS 1.3 session resumption. A remote attacker could
possibly use this issue to bypass access control. (CVE-2025-23048)
Anthony CORSIEZ discovered that the Apache HTTP Server mod_proxy_http2
module incorrectly handled missing host headers. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2025-49630)
Robert Merget discovered that the Apache HTTP Server mod_ssl module
incorrectly handled TLS upgrades. A remote attacker could possibly use this
issue to hijack an HTTP session. This update removes the old "SSLEngine
optional" configuration option, possibly requiring a configuration change
in certain environments. (CVE-2025-49812)
Gal Bar Nahum discovered that the Apache HTTP Server incorrectly handled
certain memory operations. A remote attacker could possibly use this
issue to cause the server to consume resources, leading to a denial of
service. (CVE-2025-53020)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | apache2 | 2.4.52-1ubuntu4.15 |
| Ubuntu · 24.04 LTS 24.04:LTS | apache2 | 2.4.58-1ubuntu8.7 |
Vulnerabilities 7
-
Critical 9.1CVE-2025-23048 Public exploit
Apache HTTP Server: mod_ssl access control bypass with session resumption
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…
-
High 7.5
Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…
-
High 7.5
Apache HTTP Server: SSRF with mod_headers setting Content-Type header
SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header …
-
High 7.5
Apache HTTP Server: mod_ssl error log variable escaping
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…
-
High 7.5
Apache HTTP Server: mod_proxy_http2 denial of service
In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured f…
-
High 7.5CVE-2025-53020 Public exploit
Apache HTTP Server: HTTP/2 DoS by Memory Increase
Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.
-
High 7.4CVE-2025-49812 Public exploit
Apache HTTP Server: mod_ssl TLS upgrade attack
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…
References
-
report
https://ubuntu.com/security/CVE-2024-42516
-
report
https://ubuntu.com/security/CVE-2024-43204
-
report
https://ubuntu.com/security/CVE-2024-47252
-
report
https://ubuntu.com/security/CVE-2025-23048
-
report
https://ubuntu.com/security/CVE-2025-49630
-
report
https://ubuntu.com/security/CVE-2025-49812
-
report
https://ubuntu.com/security/CVE-2025-53020