Denial of Service Vulnerability in Apache HTTP Server - ALPINE-CVE-2025-49630
Summary
ALPINE-CVE-2025-49630: In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Affects apache2 versions < 2.4.64-r0. Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, security features, and support for various protocols. However, certain configurations can expose it to vulnerabilities, such as the one identified in this report, which affects versions 2.4.26 through 2.4.63 when configured as a reverse proxy with HTTP/2 backends.
Vulnerability Detail
The vulnerability arises from specific proxy configurations where untrusted clients can trigger a denial of service attack against Apache HTTP Server. This occurs due to an assertion failure in the mod_proxy_http2 module when ProxyPreserveHost is set to 'on'. Attackers can exploit this flaw to disrupt service availability, leading to potential downtime and loss of access for legitimate users.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the ProxyPreserveHost setting or avoiding the use of HTTP/2 backends until the package can be updated. This can be done by modifying your Apache configuration file (httpd.conf or apache2.conf) and commenting out or removing the line: 'ProxyPreserveHost On'.
Conclusion
In summary, the vulnerability identified as ALPINE-CVE-2025-49630 poses a significant risk to Apache HTTP Server when configured in certain proxy scenarios. It is crucial to update to the patched version 2.4.64-r0 or implement the recommended workarounds to mitigate potential denial of service attacks.
See every vulnerability recorded for apache2 →
FAQ
The vulnerability affects Apache HTTP Server versions 2.4.26 through 2.4.63.
The vulnerability can lead to a denial of service attack, causing service disruption for legitimate users.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider implementing the suggested workaround by disabling ProxyPreserveHost or avoiding HTTP/2 backends.
More details can be found in the CVE report for ALPINE-CVE-2025-49630, which outlines the specifics of the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
