Description
A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".
Users are recommended to upgrade to version 2.4.65, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.64 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.4.65-1 | — |
| Debian 13 | apache2 | 2.4.65-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.65-1.1 | openSUSE-SU-2025:15384-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache2 | 2.4.65-r0 | — |
| Alpine v3.23 | apache2 | 2.4.65-r0 | — |
| Alpine v3.22 | apache2 | 2.4.65-r0 | — |
| Alpine v3.21 | apache2 | 2.4.65-r0 | — |
| Alpine v3.20 | apache2 | 2.4.65-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache2 | 2.4.65-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | httpd +8 | 2.4.65-1.amzn2023.0.1 | ALAS2023-2025-1183 |
| Amazon Linux 2023 | mod_ssl +1 | 1:2.4.65-1.amzn2023.0.1 | ALAS2023-2025-1183 |
| Amazon Linux 2 | httpd +7 | 2.4.65-1.amzn2.0.2 | ALAS2-2025-2982 |
| Amazon Linux 2 | mod_ssl +1 | 1:2.4.65-1.amzn2.0.2 | ALAS2-2025-2982 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | httpd | 2.4.65-1 | — |
Advisories 7
- openSUSE-SU-2025:15384-1 apache2-2.4.65-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1636 Apache HTTP Server: Schwachstelle ermöglicht umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 11, 2026
- WID-SEC-2025-2361 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- ALAS2023-2025-1183 Moderate: httpd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 15, 2025
- ALAS2-2025-2982 Moderate: httpd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 4, 2025
References
- https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory