Critical HTTP Desynchronisation Attack in Apache HTTP Server - CVE-2025-49812
Summary
CVE-2025-49812: In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Affects apache2 across 2 version ranges.
< 2.4.64-r0
< 7e926454793abd7d71b6afc8bd1ec1648752c6ad
Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, security features, and extensive module support. However, certain configurations of mod_ssl in Apache versions up to 2.4.63 are vulnerable to a critical security issue that allows man-in-the-middle attacks through HTTP desynchronisation.
Vulnerability Detail
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. This vulnerability arises specifically when the 'SSLEngine optional' directive is used to enable TLS upgrades, making it possible for attackers to intercept and manipulate HTTP sessions, potentially leading to unauthorized access to sensitive information.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to disable the 'SSLEngine optional' directive in the Apache configuration to prevent TLS upgrades, thereby mitigating the risk of this vulnerability until a proper update can be applied.
Conclusion
CVE-2025-49812 represents a significant security risk for users of Apache HTTP Server versions up to 2.4.63. It is crucial for users to upgrade to version 2.4.64 or later to mitigate this vulnerability. Additionally, understanding the implications and applying workarounds can help protect against potential attacks.
See every vulnerability recorded for apache2 →
FAQ
CVE-2025-49812 is a vulnerability in Apache HTTP Server that allows man-in-the-middle attacks through HTTP desynchronisation due to certain mod_ssl configurations.
Apache HTTP Server versions up to 2.4.63 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, disable the 'SSLEngine optional' directive in your Apache configuration as a temporary workaround.
The vulnerability could allow attackers to hijack HTTP sessions, leading to unauthorized access to sensitive information and potential data breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
