Denial of Service Vulnerability in Apache HTTP Server (CVE-2025-49630)
Summary
CVE-2025-49630: In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Affects apache2 across 2 version ranges.
< 2.4.64-r0
>= 3cdd2d84507d2a86eb5dab2eec96f1035bb76d6c, < 7e926454793abd7d71b6afc8bd1ec1648752c6ad
Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content over the internet. It is known for its flexibility, power, and extensive feature set, including support for various protocols, modules, and configurations. However, certain configurations can expose it to vulnerabilities, such as the one identified in CVE-2025-49630, which affects versions 2.4.26 through 2.4.63.
Vulnerability Detail
CVE-2025-49630 is a denial of service vulnerability that can be triggered in Apache HTTP Server when it is configured as a reverse proxy for an HTTP/2 backend with the ProxyPreserveHost directive set to 'on'. Untrusted clients can exploit this configuration, leading to an assertion failure in the mod_proxy_http2 module. This can result in the server becoming unresponsive, affecting the availability of the web services it hosts.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the ProxyPreserveHost directive or ensuring that only trusted clients can access the reverse proxy configuration. This can be done by modifying your Apache configuration file (usually located at /etc/apache2/apache2.conf) and commenting out or removing the line:
ProxyPreserveHost On
Conclusion
CVE-2025-49630 is a critical denial of service vulnerability affecting specific versions of Apache HTTP Server. Users are advised to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server versions 2.4.26 through 2.4.63 are affected by CVE-2025-49630.
The vulnerability can lead to a denial of service, causing the server to become unresponsive when exploited by untrusted clients.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Yes, the patch is available in version 2.4.64-r0 and later for the affected Apache HTTP Server versions.
If an immediate update is not possible, consider implementing workarounds such as disabling the ProxyPreserveHost directive or restricting access to trusted clients.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
