Critical Security Update for Apache HTTP Server Packages in AlmaLinux: Moderate Vulnerabilities Identified
Summary
ALSA-2025:15095: Moderate: httpd security update. Affects httpd versions < 2.4.63-1.el10_0.2. Fixed in 2.4.63-1.el10_0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, provided by the httpd packages, is a widely used web server known for its performance, extensibility, and flexibility. It supports various features such as SSL/TLS for secure connections, URL rewriting, and authentication mechanisms. However, recent vulnerabilities have been identified that could compromise the security of web applications relying on this server.
Vulnerability Detail
The vulnerabilities stem from insufficient escaping of user-supplied data in mod_ssl, which could lead to potential security breaches. Specifically, CVE-2024-47252 allows attackers to exploit this flaw, while CVE-2025-23048 presents an access control bypass issue through TLS 1.3 session resumption. Additionally, CVE-2025-49812 highlights a risk of HTTP session hijacking via TLS upgrades. These vulnerabilities could lead to unauthorized access, data breaches, and compromised user sessions.
How To Fix
Minimum fixed version
2.4.63-1.el10_0.2
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling mod_ssl or restricting access to sensitive areas of your web application until the packages are updated. However, this is not a long-term solution and should only be used until the update can be applied.
Conclusion
In summary, the Apache HTTP Server packages in AlmaLinux have been identified with moderate vulnerabilities that could pose significant security risks. It is crucial to update to the latest patched versions to ensure the security of your web applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for httpd →
FAQ
The main vulnerabilities include insufficient escaping of user-supplied data in mod_ssl, access control bypass via TLS 1.3 session resumption, and HTTP session hijacking through TLS upgrades.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
It is recommended to update to the patched version 2.4.63-1.el10_0.2 as soon as possible to mitigate the risks associated with these vulnerabilities.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be leveraged by attackers to gain unauthorized access or hijack user sessions.
If immediate updates are not possible, consider implementing temporary workarounds such as disabling mod_ssl or restricting access to sensitive areas of your application.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
