CVE-2025-49812

Description

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

References

https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.openwall.com/lists/oss-security/2025/07/10/9

http://www.openwall.com/lists/oss-security/2025/07/10/2

http://www.openwall.com/lists/oss-security/2025/07/09/3

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS