Moderate Security Update for Apache HTTP Server (httpd) - Multiple Vulnerabilities Addressed
Summary
ALSA-2025:15023: Moderate: httpd security update. Affects httpd versions < 2.4.62-4.el9_6.4. Fixed in 2.4.62-4.el9_6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely-used open-source web server known for its robustness, flexibility, and extensibility. It serves as the backbone for many websites, providing essential features such as support for various protocols, authentication, and access control. However, like any software, it is susceptible to vulnerabilities that can compromise its security and functionality. The recent vulnerabilities identified in httpd highlight the importance of maintaining updated software to protect against potential threats.
Vulnerability Detail
The vulnerabilities in the httpd packages stem from insufficient escaping of user-supplied data in mod_ssl, which could lead to security breaches. Specifically, CVE-2024-47252 allows attackers to exploit this weakness, while CVE-2025-23048 presents an access control bypass risk through TLS 1.3 session resumption. Additionally, CVE-2025-49812 raises concerns about HTTP session hijacking via a TLS upgrade. These vulnerabilities can result in unauthorized access, data breaches, and compromised user sessions, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
2.4.62-4.el9_6.4
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement stricter access controls and avoid using TLS 1.3 session resumption until the update is applied. This may involve configuring the server settings to limit access based on IP addresses or implementing additional authentication measures.
Conclusion
The recent vulnerabilities identified in the Apache HTTP Server (httpd) underscore the importance of timely updates and security measures. By addressing these vulnerabilities through updates and implementing workarounds, users can significantly mitigate the risks associated with these security issues.
See every vulnerability recorded for httpd →
FAQ
The main vulnerabilities include insufficient escaping of user-supplied data in mod_ssl, access control bypass via TLS 1.3 session resumption, and HTTP session hijacking through TLS upgrades.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
These vulnerabilities can lead to unauthorized access, data breaches, and compromised user sessions, posing significant risks to web applications.
Yes, a patch is available in version 2.4.62-4.el9_6.4 of the httpd package. Users are encouraged to update to this version.
If immediate updates are not possible, implement stricter access controls and avoid using TLS 1.3 session resumption as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
