Red Hat Security Advisory

RHSA-2025:14903

httpd security update

Released 2025-08-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.4) httpd-2.4.57-11.el9_4.3, httpd-core-2.4.57-11.el9_4.3, httpd-devel-2.4.57-11.el9_4.3 +8

Fixes 3 records

TI-2025-16857 CVE-2025-23048 · GHSA-gh64-76r6-qhpc

Apache HTTP Server: mod_ssl access control bypass with session resumption

HIGH 80

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0104 Published 2025-07-10 Fixed CWE-284

TI-2024-31587 CVE-2024-47252 · GHSA-2qfr-q5v6-m43q

Apache HTTP Server: mod_ssl error log variable escaping

MEDIUM 40

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00795 Published 2025-07-10 Partial fix CWE-150

TI-2025-31736 CVE-2025-49812 · GHSA-2mcx-3xj5-wg86

Apache HTTP Server: mod_ssl TLS upgrade attack

LOW 35

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00614 Published 2025-07-10 Fixed CWE-287