CVE-2025-49812

Description

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

Reserved 2025-06-11 | Published 2025-07-10 | Updated 2025-07-10 | Assigner apache

Problem types

CWE-287 Improper Authentication

Product status

Default status
unaffected

Any version
affected

Timeline

2025-04-22:	Report received
2025-07-07:	2.4.x revision 1927045

Credits

Robert Merget (Technology Innovation Institute) finder

Nurullah Erinola (Ruhr University Bochum) finder

Marcel Maehren (Ruhr University Bochum) finder

Lukas Knittel (Ruhr University Bochum) finder

Sven Hebrok (Paderborn University) finder

Marcus Brinkmann (Ruhr University Bochum) finder

Juraj Somorovsky (Paderborn University) finder

Jörg Schwenk (Ruhr University Bochum) finder

References

httpd.apache.org/security/vulnerabilities_24.html vendor-advisory

cve.org (CVE-2025-49812)

nvd.nist.gov (CVE-2025-49812)

Download JSON