Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• Critical 9.1
  CVE-2025-23048 Public exploit

  Apache HTTP Server: mod_ssl access control bypass with session resumption

  In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2024-42516

  Apache HTTP Server: HTTP response splitting

  HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2024-43204

  Apache HTTP Server: SSRF with mod_headers setting Content-Type header

  SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header …

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2024-43394

  Apache HTTP Server: SSRF on Windows due to UNC paths

  Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via  mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 thro…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
  Jul 10, 2025
• High 7.5
  CVE-2024-47252

  Apache HTTP Server: mod_ssl error log variable escaping

  Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2025-49630

  Apache HTTP Server: mod_proxy_http2 denial of service

  In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured f…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2025-53020 Public exploit

  Apache HTTP Server: HTTP/2 DoS by Memory Increase

  Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.4
  CVE-2025-49812 Public exploit

  Apache HTTP Server: mod_ssl TLS upgrade attack

  In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.3
  CVE-2023-38709 Public exploit

  Apache HTTP Server: HTTP response splitting

  Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Apr 4, 2024

Revision history

1. 2026-11-11 #81

   Neue Updates von Red Hat aufgenommen

2. 2026-11-10 #80

   Neue Updates von Red Hat aufgenommen

3. 2026-10-29 #79

   Neue Updates von Red Hat aufgenommen

4. 2026-10-26 #78

   Neue Updates von Oracle Linux aufgenommen

5. 2026-10-22 #77

   Neue Updates von Oracle Linux aufgenommen

6. 2026-10-21 #76

   Neue Updates von IBM aufgenommen

7. 2026-10-14 #75

   Neue Updates von Red Hat aufgenommen

8. 2026-09-21 #74

   Neue Updates von IBM aufgenommen

9. 2026-09-13 #73

   Neue Updates von Red Hat aufgenommen

10. 2026-09-10 #72

    Neue Updates von Oracle Linux aufgenommen

11. 2026-09-09 #71

    Neue Updates von Red Hat aufgenommen

12. 2026-09-01 #70

    Neue Updates von Red Hat aufgenommen

13. 2026-08-26 #69

    Neue Updates von Oracle Linux aufgenommen

14. 2026-08-25 #68

    Neue Updates von Oracle Linux aufgenommen

15. 2026-08-19 #67

    Neue Updates von Red Hat aufgenommen

16. 2026-08-17 #66

    Neue Updates von Red Hat aufgenommen

17. 2026-08-13 #65

    Neue Updates von Gentoo aufgenommen

18. 2026-08-11 #64

    Neue Updates von Red Hat aufgenommen

19. 2026-08-04 #63

    Neue Updates von Red Hat aufgenommen

20. 2026-07-27 #62

    Neue Updates von Red Hat aufgenommen

21. 2026-07-23 #61

    Neue Updates von Oracle Linux aufgenommen

22. 2026-07-22 #60

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

23. 2026-07-21 #59

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

24. 2026-07-20 #58

    Neue Updates von Oracle Linux aufgenommen

25. 2026-07-19 #57

    Neue Updates von Oracle Linux aufgenommen

References

• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/20
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/21
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/22
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/23
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/24
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/25
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/26
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/27
• Mailing List OSS Security vom 2025-07-10
  https://seclists.org/oss-sec/2025/q3/28
• Fedora Security Advisory FEDORA-2025-6D7A183951 vom 2025-07-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-6d7a183951
• Fedora Security Advisory FEDORA-2025-B486FFD351 vom 2025-07-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-b486ffd351
• Ubuntu Security Notice USN-7639-1 vom 2025-07-16
  https://ubuntu.com/security/notices/USN-7639-1
• IBM Security Bulletin 7239846 vom 2025-07-16
  https://www.ibm.com/support/pages/node/7239846
• openSUSE Security Update OPENSUSE-SU-2025:15360-1 vom 2025-07-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CB2NNDXYFXVKF6KTKFMA2AHUNHAGDAFJ/
• openSUSE Security Update OPENSUSE-SU-2025:15369-1 vom 2025-07-22
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UTC3TDRL5IF6YTXDS2ENK5OJDZNHZ2XL/
• SUSE Security Update SUSE-SU-2025:02565-1 vom 2025-07-31
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021991.html
• Amazon Linux Security Advisory ALAS2-2025-2958 vom 2025-08-05
  https://alas.aws.amazon.com/AL2/ALAS2-2025-2958.html
• SUSE Security Update SUSE-SU-2025:02685-1 vom 2025-08-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022063.html
• SUSE Security Update SUSE-SU-2025:02683-1 vom 2025-08-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022065.html
• SUSE Security Update SUSE-SU-2025:02682-1 vom 2025-08-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KSS462UFYDADIPPKUL3TXXRQPB3QSMVB/
• SUSE Security Update SUSE-SU-2025:02684-1 vom 2025-08-04
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJTVNIIT7LUYXSMCL3VWS2K232WNZNZG/
• IBM Security Bulletin 7241583 vom 2025-08-06
  https://www.ibm.com/support/pages/node/7241583
• F5 Security Advisory K000152924 vom 2025-08-08
  https://my.f5.com/manage/s/article/K000152924
• IBM Security Bulletin 7241939 vom 2025-08-11
  https://www.ibm.com/support/pages/node/7241939
• Debian Security Advisory DLA-4270 vom 2025-08-12
  https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html
• Red Hat Security Advisory RHSA-2025:13681 vom 2025-08-14
  https://access.redhat.com/errata/RHSA-2025:13681
• Red Hat Security Advisory RHSA-2025:13680 vom 2025-08-14
  https://access.redhat.com/errata/RHSA-2025:13680
• IBM Security Bulletin 7242375 vom 2025-08-18
  https://www.ibm.com/support/pages/node/7242375
• Ubuntu Security Notice USN-7639-2 vom 2025-08-20
  https://ubuntu.com/security/notices/USN-7639-2
• F5 Security Advisory K000153074 vom 2025-08-21
  https://my.f5.com/manage/s/article/K000153074
• Oracle Linux Security Advisory ELSA-2025-14625 vom 2025-08-27
  https://linux.oracle.com/errata/ELSA-2025-14625.html
• Red Hat Security Advisory RHSA-2025:14625 vom 2025-08-26
  https://access.redhat.com/errata/RHSA-2025:14625
• Red Hat Security Advisory RHSA-2025:14901 vom 2025-08-28
  https://access.redhat.com/errata/RHSA-2025:14901
• Red Hat Security Advisory RHSA-2025:14902 vom 2025-08-28
  https://access.redhat.com/errata/RHSA-2025:14902
• Red Hat Security Advisory RHSA-2025:14903 vom 2025-08-28
  https://access.redhat.com/errata/RHSA-2025:14903
• Red Hat Security Advisory
  https://access.redhat.com/errata/RHSA-2025:14997
• Red Hat Security Advisory RHSA-2025:14983 vom 2025-09-02
  https://access.redhat.com/errata/RHSA-2025:14983
• Red Hat Security Advisory RHSA-2025:14998 vom 2025-09-02
  https://access.redhat.com/errata/RHSA-2025:14998
• Red Hat Security Advisory RHSA-2025:15036 vom 2025-09-02
  https://access.redhat.com/errata/RHSA-2025:15036
• Red Hat Security Advisory RHSA-2025:15023 vom 2025-09-02
  https://access.redhat.com/errata/RHSA-2025:15023
• Red Hat Security Advisory RHSA-2025:15095 vom 2025-09-02
  https://access.redhat.com/errata/RHSA-2025:15095
• Oracle Linux Security Advisory ELSA-2025-15023 vom 2025-09-02
  https://linux.oracle.com/errata/ELSA-2025-15023.html
• Oracle Linux Security Advisory ELSA-2025-14983 vom 2025-09-02
  https://linux.oracle.com/errata/ELSA-2025-14983.html
• Oracle Linux Security Advisory ELSA-2025-15095 vom 2025-09-03
  https://linux.oracle.com/errata/ELSA-2025-15095.html
• Red Hat Security Advisory RHSA-2025:15123 vom 2025-09-03
  https://access.redhat.com/errata/RHSA-2025:15123
• Oracle Linux Security Advisory ELSA-2025-15123 vom 2025-09-05
  http://linux.oracle.com/errata/ELSA-2025-15123.html
• Red Hat Security Advisory RHSA-2025:15516 vom 2025-09-08
  https://access.redhat.com/errata/RHSA-2025:15516
• Rocky Linux Security Advisory RLSA-2025:15123 vom 2025-09-08
  https://errata.build.resf.org/RLSA-2025:15123
• Red Hat Security Advisory RHSA-2025:15619 vom 2025-09-10
  https://access.redhat.com/errata/RHSA-2025:15619
• Red Hat Security Advisory RHSA-2025:15684 vom 2025-09-11
  https://access.redhat.com/errata/RHSA-2025:15684
• Red Hat Security Advisory RHSA-2025:15698 vom 2025-09-11
  https://access.redhat.com/errata/RHSA-2025:15698
• Red Hat Security Advisory RHSA-2025:15726 vom 2025-09-15
  https://access.redhat.com/errata/RHSA-2025:15726
• Red Hat Security Advisory RHSA-2025:15727 vom 2025-09-15
  https://access.redhat.com/errata/RHSA-2025:15727
• Red Hat Security Advisory RHSA-2025:15725 vom 2025-09-15
  https://access.redhat.com/errata/RHSA-2025:15725
• EVE-NG Professional Release notes vom 2025-09-18
  https://www.eve-ng.net/index.php/documentation/release-notes/
• IBM Security Bulletin 7247015 vom 2025-10-03
  https://www.ibm.com/support/pages/node/7247015
• Rocky Linux Security Advisory RLSA-2025:14983 vom 2025-10-10
  https://errata.build.resf.org/RLSA-2025:14983
• Rocky Linux Security Advisory RLSA-2025:15023 vom 2025-10-10
  https://errata.build.resf.org/RLSA-2025:15023
• Oracle Linux Security Advisory ELSA-2025-14997 vom 2025-10-16
  https://linux.oracle.com/errata/ELSA-2025-14997.html
• Dell Security Advisory DSA-2025-404 vom 2025-10-31
  https://www.dell.com/support/kbdoc/000385435
• Dell Security Advisory DSA-2025-390 vom 2025-11-05
  https://www.dell.com/support/kbdoc/000385230
• Dell Security Advisory DSA-2025-381 vom 2025-11-10
  https://www.dell.com/support/kbdoc/de-de/000390206/dsa-2025-381-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
• IBM Security Bulletin 7250971 vom 2025-11-12
  https://www.ibm.com/support/pages/node/7250971
• XEROX Security Advisory XRX25-018 vom 2025-11-18
  https://security.business.xerox.com/wp-content/uploads/2025/11/Xerox-Security-Bulletin-XRX25-018-Xerox-FreeFlow-Print-Server-v7.pdf
• IBM Security Bulletin 7252038 vom 2025-11-20
  https://www.ibm.com/support/pages/node/7252038
• HP Security Bulletin HPESBUX04975 vom 2025-11-24
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04975en_us&docLocale=en_US
• Dell Security Advisory DSA-2025-365 vom 2025-12-01
  https://www.dell.com/support/kbdoc/de-de/000397532/dsa-2025-365-security-update-for-dell-networker-multiple-third-party-component-vulnerabilities
• Oracle Linux Security Advisory ELSA-2025-23932 vom 2025-12-23
  https://linux.oracle.com/errata/ELSA-2025-23932.html
• Oracle Linux Security Advisory ELSA-2025-23919 vom 2025-12-23
  https://linux.oracle.com/errata/ELSA-2025-23919.html
• Oracle Linux Security Advisory ELSA-2025-23732 vom 2025-12-26
  http://linux.oracle.com/errata/ELSA-2025-23732.html
• Dell Knowledge Base Article
  https://www.dell.com/support/kbdoc/en-us/000405813/dsa-2025-415-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
• IBM Security Bulletin 7259417 vom 2026-02-04
  https://www.ibm.com/support/pages/node/7259417
• QNAP Security Advisory QSA-26-04 vom 2026-02-11
  https://www.qnap.com/go/security-advisory/qsa-26-04
• Ubuntu Security Notice USN-8338-1 vom 2026-05-28
  https://ubuntu.com/security/notices/USN-8338-1
• openSUSE Security Update OPENSUSE-SU-2026:20810-1 vom 2026-05-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XOVJ4T6O6CSTSYOREEQDLPHZCQ5QDWLP/
• Ubuntu Security Notice USN-8338-2 vom 2026-05-29
  https://ubuntu.com/security/notices/USN-8338-2
• Rocky Linux Security Advisory RLSA-2026:22140 vom 2026-06-01
  https://errata.build.resf.org/RLSA-2026:22140
• Red Hat Security Advisory RHSA-2026:22140 vom 2026-06-01
  https://access.redhat.com/errata/RHSA-2026:22140
• SUSE Security Update SUSE-SU-2026:21846-1 vom 2026-06-01
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026436.html
• Red Hat Security Advisory RHSA-2026:22528 vom 2026-06-03
  https://access.redhat.com/errata/RHSA-2026:22528