CVE-2024-47252 — Apache HTTP Server: mod_ssl error log variable escaping

Description

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.

In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	2.4 – ≤ 2.4.63	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.64-1	—
Debian 13	apache2	2.4.64-1	—
Debian 12	apache2	2.4.65-1~deb12u1	—
Debian 11	apache2	2.4.65-1~deb11u1	DLA-4270-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	apache2	2.4.64-1ubuntu2	—
Ubuntu 24.04 LTS	apache2	2.4.58-1ubuntu8.7	USN-7639-1
Ubuntu 22.04 LTS	apache2	2.4.52-1ubuntu4.15	USN-7639-1

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	apache2	2.4.41-4ubuntu3.23+esm2	USN-8338-1, USN-7639-2
Ubuntu Pro 18.04 LTS	apache2	2.4.29-1ubuntu4.27+esm6	USN-8338-1, USN-7639-2
Ubuntu Pro 16.04 LTS	apache2	2.4.18-2ubuntu3.17+esm16	USN-8338-1, USN-7639-2
Ubuntu Pro 14.04 LTS	apache2	2.4.7-1ubuntu4.22+esm12	USN-8338-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	httpd +8	2.4.63-1.el10_0.2	RHSA-2025:15095
RHEL 10	mod_ssl +1	1:2.4.63-1.el10_0.2	RHSA-2025:15095
RHEL 9	httpd +8	2.4.62-4.el9_6.4	RHSA-2025:15023
RHEL 9	mod_ssl +1	1:2.4.62-4.el9_6.4	RHSA-2025:15023
RHEL 8	httpd +6	2.4.37-65.module+el8.10.0+23369+11a81384.5	RHSA-2025:15123
RHEL 8	mod_http2	1.15.7-10.module+el8.10.0+23369+11a81384.4	RHSA-2025:15123
RHEL 8	mod_md	1:2.0.8-8.module+el8.9.0+19080+567b90f8	RHSA-2025:15123
RHEL 8	mod_ssl +1	1:2.4.37-65.module+el8.10.0+23369+11a81384.5	RHSA-2025:15123

Show 12 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	httpd +8	2.4.57-11.el9_4.3	RHSA-2025:14903
RHEL 9.4 EUS	mod_ssl +1	1:2.4.57-11.el9_4.3	RHSA-2025:14903
RHEL 9.2 E4S	httpd +8	2.4.53-11.el9_2.13	RHSA-2025:14902
RHEL 9.2 E4S	mod_ssl +1	1:2.4.53-11.el9_2.13	RHSA-2025:14902
RHEL 9.0 E4S	httpd +7	2.4.51-7.el9_0.10	RHSA-2025:14901
RHEL 9.0 E4S	mod_ssl +1	1:2.4.51-7.el9_0.10	RHSA-2025:14901
RHEL 8.8 E4S	httpd +6	2.4.37-56.module+el8.8.0+23464+a2e0c444.10	RHSA-2025:15619
RHEL 8.8 E4S	mod_http2	1.15.7-8.module+el8.8.0+23464+a2e0c444.6	RHSA-2025:15619
RHEL 8.8 E4S	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2025:15619
RHEL 8.8 E4S	mod_ssl +1	1:2.4.37-56.module+el8.8.0+23464+a2e0c444.10	RHSA-2025:15619
RHEL 8.6 TUS	httpd +6	2.4.37-47.module+el8.6.0+23463+5d5709c6.11	RHSA-2025:15698
RHEL 8.6 TUS	mod_http2	1.15.7-5.module+el8.6.0+23463+5d5709c6.4	RHSA-2025:15698
RHEL 8.6 TUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2025:15698
RHEL 8.6 TUS	mod_ssl +1	1:2.4.37-47.module+el8.6.0+23463+5d5709c6.11	RHSA-2025:15698
RHEL 8.6 E4S	httpd +6	2.4.37-47.module+el8.6.0+23463+5d5709c6.11	RHSA-2025:15698
RHEL 8.6 E4S	mod_http2	1.15.7-5.module+el8.6.0+23463+5d5709c6.4	RHSA-2025:15698
RHEL 8.6 E4S	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2025:15698
RHEL 8.6 E4S	mod_ssl +1	1:2.4.37-47.module+el8.6.0+23463+5d5709c6.11	RHSA-2025:15698
RHEL 8.6 AUS	httpd +6	2.4.37-47.module+el8.6.0+23463+5d5709c6.11	RHSA-2025:15698
RHEL 8.6 AUS	mod_http2	1.15.7-5.module+el8.6.0+23463+5d5709c6.4	RHSA-2025:15698
RHEL 8.6 AUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2025:15698
RHEL 8.6 AUS	mod_ssl +1	1:2.4.37-47.module+el8.6.0+23463+5d5709c6.11	RHSA-2025:15698
RHEL 8.4 EUS Long Life	httpd +6	2.4.37-39.module+el8.4.0+23462+1fa78ba3.10	RHSA-2025:15684
RHEL 8.4 EUS Long Life	mod_http2	1.15.7-3.module+el8.4.0+23462+1fa78ba3.4	RHSA-2025:15684
RHEL 8.4 EUS Long Life	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2025:15684
RHEL 8.4 EUS Long Life	mod_ssl +1	1:2.4.37-39.module+el8.4.0+23462+1fa78ba3.10	RHSA-2025:15684
RHEL 8.4 AUS	httpd +6	2.4.37-39.module+el8.4.0+23462+1fa78ba3.10	RHSA-2025:15684
RHEL 8.4 AUS	mod_http2	1.15.7-3.module+el8.4.0+23462+1fa78ba3.4	RHSA-2025:15684
RHEL 8.4 AUS	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611	RHSA-2025:15684
RHEL 8.4 AUS	mod_ssl +1	1:2.4.37-39.module+el8.4.0+23462+1fa78ba3.10	RHSA-2025:15684
RHEL 8.2 AUS	httpd +6	2.4.37-21.module+el8.2.0+23461+1d03af5c.10	RHSA-2025:15516
RHEL 8.2 AUS	mod_http2	1.11.3-3.module+el8.2.0+23461+1d03af5c.5	RHSA-2025:15516
RHEL 8.2 AUS	mod_md	1:2.0.8-7.module+el8.2.0+5531+7e4d69a2	RHSA-2025:15516
RHEL 8.2 AUS	mod_ssl +1	1:2.4.37-21.module+el8.2.0+23461+1d03af5c.10	RHSA-2025:15516
RHEL 7 ELS	httpd +5	2.4.6-99.el7_9.6	RHSA-2025:14997
RHEL 7 ELS	mod_ssl +1	1:2.4.6-99.el7_9.6	RHSA-2025:14997
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.62-8.el7jbcs	RHSA-2025:13680
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_http2	2.0.29-5.el7jbcs	RHSA-2025:13680
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_jk +1	1.2.50-9.redhat_1.el7jbcs	RHSA-2025:13680
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_md	1:2.4.28-10.el7jbcs	RHSA-2025:13680
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_proxy_cluster	1.3.22-4.el7jbcs	RHSA-2025:13680
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_security	2.9.6-11.el7jbcs	RHSA-2025:13680
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.62-8.el7jbcs	RHSA-2025:13680

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	httpd-manual +1	2.4.63-1.el10_0.2	ALSA-2025:15095
AlmaLinux 9	httpd +8	2.4.62-4.el9_6.4	ALSA-2025:15023
AlmaLinux 9	mod_ssl +1	1:2.4.62-4.el9_6.4	ALSA-2025:15023
AlmaLinux 8	httpd +6	2.4.37-65.module_el8.10.0+4044+ea5f78b1.5	ALSA-2025:15123
AlmaLinux 8	mod_http2	1.15.7-10.module_el8.10.0+4044+ea5f78b1.4	ALSA-2025:15123
AlmaLinux 8	mod_md	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa	ALSA-2025:15123
AlmaLinux 8	mod_ssl +1	1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5	ALSA-2025:15123

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	httpd	2.4.63-1.el10_0.2	RLSA-2025:15095
Rocky Linux 9	httpd	2.4.62-4.el9_6.4	RLSA-2025:15023
Rocky Linux 8	httpd	2.4.37-65.module+el8.10.0+1830+22f0c9e0	RLSA-2025:15123
Rocky Linux 8	mod_http2	1.15.7-10.module+el8.10.0+1775+6b057638	RLSA-2025:15123
Rocky Linux 8	mod_md	1:2.0.8-8.module+el8.9.0+1370+89cc8ad5	RLSA-2025:15123

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	apache2	2.4.51-150400.6.46.1	SUSE-SU-2025:02685-1, SUSE-SU-2025:02682-1
SLES 15 SP7	apache2-devel +4	2.4.62-150700.4.3.1	SUSE-SU-2025:02685-1
SLES 15 SP6	apache2	2.4.51-150400.6.46.1	SUSE-SU-2025:02684-1, SUSE-SU-2025:02682-1
SLES 15 SP6	apache2-devel +4	2.4.58-150600.5.35.1	SUSE-SU-2025:02684-1
SLES 15 SP5	apache2	2.4.51-150400.6.46.1	SUSE-SU-2026:2686-1, SUSE-SU-2025:02682-1
SLES 15 SP4	apache2	2.4.51-150400.6.46.1	SUSE-SU-2026:2686-1, SUSE-SU-2025:02682-1
SLES 15 SP3	apache2	2.4.51-150200.3.82.1	SUSE-SU-2025:02683-1

Show 10 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	apache2 +1	2.4.51-35.69.1	SUSE-SU-2025:02565-1
SLES for SAP 15 SP5	apache2	2.4.51-150400.6.46.1	SUSE-SU-2026:2686-1, SUSE-SU-2025:02682-1
SLES for SAP 15 SP4	apache2	2.4.51-150400.6.46.1	SUSE-SU-2026:2686-1, SUSE-SU-2025:02682-1
SLES for SAP 15 SP3	apache2	2.4.51-150200.3.82.1	SUSE-SU-2025:02683-1
SLE HPC 15 SP5	apache2	2.4.51-150400.6.46.1	SUSE-SU-2026:2686-1, SUSE-SU-2025:02682-1
SLE HPC 15 SP4	apache2	2.4.51-150400.6.46.1	SUSE-SU-2026:2686-1, SUSE-SU-2025:02682-1
SLE HPC 15 SP3	apache2	2.4.51-150200.3.82.1	SUSE-SU-2025:02683-1
SUSE Manager Server 4.3	apache2	2.4.51-150400.6.46.1	SUSE-SU-2025:02682-1
SUSE Manager Proxy 4.3	apache2	2.4.51-150400.6.46.1	SUSE-SU-2025:02682-1
SUSE Enterprise Storage 7.1	apache2	2.4.51-150200.3.82.1	SUSE-SU-2025:02683-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2	2.4.64-1.1	openSUSE-SU-2025:15360-1
openSUSE Leap 15.6	apache2 +6	2.4.58-150600.5.35.1	SUSE-SU-2025:02684-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.64-r0	—
Alpine v3.23	apache2	2.4.64-r0	—
Alpine v3.22	apache2	2.4.64-r0	—
Alpine v3.21	apache2	2.4.64-r0	—
Alpine v3.20	apache2	2.4.64-r0	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	apache2	2.4.64-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	httpd +8	2.4.64-1.amzn2023.0.1	ALAS2023-2025-1125
Amazon Linux 2023	mod_ssl +1	1:2.4.64-1.amzn2023.0.1	ALAS2023-2025-1125
Amazon Linux 2	httpd +7	2.4.64-1.amzn2.0.1	ALAS2-2025-2958
Amazon Linux 2	mod_ssl +1	1:2.4.64-1.amzn2.0.1	ALAS2-2025-2958

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	httpd	2.4.64-1	—
Azure Linux 2 (CBL-Mariner)	httpd	2.4.64-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	httpd +8	2.4.63-1.0.1.el10_0.2	ELSA-2025-15095
Oracle Linux 10	mod_ssl +1	1:2.4.63-1.0.1.el10_0.2	ELSA-2025-15095
Oracle Linux 9	httpd +8	2.4.62-4.0.1.el9_6.4	ELSA-2025-15023
Oracle Linux 9	mod_ssl +1	1:2.4.62-4.0.1.el9_6.4	ELSA-2025-15023
Oracle Linux 8	httpd +6	2.4.37-65.0.1.module+el8.10.0+90652+bef864ba.5	ELSA-2025-15123
Oracle Linux 8	mod_http2	1.15.7-10.module+el8.10.0+90652+bef864ba.4	ELSA-2025-15123
Oracle Linux 8	mod_md	1:2.0.8-8.module+el8.9.0+90011+2f9c6a23	ELSA-2025-15123
Oracle Linux 8	mod_ssl +1	1:2.4.37-65.0.1.module+el8.10.0+90652+bef864ba.5	ELSA-2025-15123
Oracle Linux 7	httpd +5	2.4.6-99.0.7.el7_9.1	ELSA-2025-14997
Oracle Linux 7	mod_ssl +1	1:2.4.6-99.0.7.el7_9.1	ELSA-2025-14997

Advisories 39

WID-SEC-2025-1529 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
ALSA-2025:15023 Moderate: httpd security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:15095 Moderate: httpd security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:15123 Moderate: httpd:2.4 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2025:15698 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:15684 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:15516 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:15619 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:15123 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:15095 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:15023 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:14997 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:14902 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:14903 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:14901 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:13680 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
WID-SEC-2026-0162 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2026
SUSE-SU-2026:2686-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 1, 2026
USN-7639-2 apache2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-8338-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
USN-7639-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
openSUSE-SU-2025:15360-1 apache2-2.4.64-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:02683-1 Security update for apache2 SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:02682-1 Security update for apache2 SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:02684-1 Security update for apache2 SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:02685-1 Security update for apache2 SUSE / openSUSE Security Updates · Mar 23, 2026
DLA-4270-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2025:02565-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
NCSC-2026-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 21, 2026
WID-SEC-2025-1850 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 17, 2025
ELSA-2025-14997 Moderate: httpd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
RLSA-2025:15023 Moderate: httpd security update Rocky Linux Security Advisories · Oct 10, 2025
RLSA-2025:15095 Moderate: httpd security update Rocky Linux Security Advisories · Oct 8, 2025
RLSA-2025:15123 Moderate: httpd:2.4 security update Rocky Linux Security Advisories · Sep 8, 2025
ELSA-2025-15123 Moderate: httpd:2.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 4, 2025
ELSA-2025-15095 Moderate: httpd security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 3, 2025
ELSA-2025-15023 Moderate: httpd security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 2, 2025
ALAS2023-2025-1125 Important: httpd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 8, 2025
ALAS2-2025-2958 Important: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 4, 2025

References

https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory

EUVD	v3.1	7.5
CISA-ADP	v3.1	7.5