Red Hat Security Advisory

RHSA-2025:14998

httpd security update

Released 2025-09-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server AUS (v. 7.7) httpd-2.4.6-90.el7_7.6, httpd-devel-2.4.6-90.el7_7.6, httpd-manual-2.4.6-90.el7_7.6 +3
Red Hat Enterprise Linux Server Optional AUS (v. 7.7) mod_ldap-2.4.6-90.el7_7.6, mod_proxy_html-1:2.4.6-90.el7_7.6

Fixes 1 record

TI-2025-31736 CVE-2025-49812 · GHSA-2mcx-3xj5-wg86

Apache HTTP Server: mod_ssl TLS upgrade attack

LOW 35

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00614 Published 2025-07-10 Fixed CWE-287