CVE-2025-49812

HIGH7.4

Apache HTTP Server: mod_ssl TLS upgrade attack

Published Jul 10, 2025

Modified 4 months ago

Details

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

References

WEB

http://www.openwall.com/lists/oss-security/2025/07/09/3

WEB

http://www.openwall.com/lists/oss-security/2025/07/10/2

WEB

http://www.openwall.com/lists/oss-security/2025/07/10/9

ADVISORY

https://httpd.apache.org/security/vulnerabilities_24.html

WEB

https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html

ADVISORY