CVE-2025-49812

Description

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

PUBLISHED Reserved 2025-06-11 | Published 2025-07-10 | Updated 2025-11-04 | Assigner apache

Problem types

CWE-287 Improper Authentication

Product status

Timeline

Credits

Robert Merget (Technology Innovation Institute) finder

Nurullah Erinola (Ruhr University Bochum) finder

Marcel Maehren (Ruhr University Bochum) finder

Lukas Knittel (Ruhr University Bochum) finder

Sven Hebrok (Paderborn University) finder

Marcus Brinkmann (Ruhr University Bochum) finder

Juraj Somorovsky (Paderborn University) finder

Jörg Schwenk (Ruhr University Bochum) finder

References

lists.debian.org/debian-lts-announce/2025/08/msg00009.html

www.openwall.com/lists/oss-security/2025/07/09/3

www.openwall.com/lists/oss-security/2025/07/10/2

www.openwall.com/lists/oss-security/2025/07/10/9

httpd.apache.org/security/vulnerabilities_24.html vendor-advisory

cve.org (CVE-2025-49812)

nvd.nist.gov (CVE-2025-49812)

Download JSON