Critical HTTP Desynchronisation Attack in Apache HTTP Server - CVE-2025-49812
Summary
ALPINE-CVE-2025-49812: In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Affects apache2 versions < 2.4.64-r0. Fixed in 2.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content over the internet. It is known for its flexibility, security features, and extensive module support, making it a popular choice for hosting websites. However, certain configurations of mod_ssl in Apache versions up to 2.4.63 are vulnerable to an HTTP desynchronisation attack, which can compromise user sessions.
Vulnerability Detail
The vulnerability arises from specific configurations using 'SSLEngine optional' that allow a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. This means that if an attacker can intercept the communication, they can manipulate the session, leading to unauthorized access to sensitive information. The issue affects Apache HTTP Server versions through 2.4.63, and it is crucial for users to understand the risks associated with this configuration.
How To Fix
Minimum fixed version
2.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can disable the 'SSLEngine optional' configuration in their Apache settings to prevent the vulnerability from being exploited. This can be done by modifying the Apache configuration file (httpd.conf or apache2.conf) and ensuring that the SSLEngine directive is set to 'off' or not included.
Conclusion
In summary, CVE-2025-49812 presents a significant risk to Apache HTTP Server users who have specific mod_ssl configurations. It is essential to upgrade to version 2.4.64 or later to eliminate this vulnerability. Users should also consider disabling vulnerable configurations as a temporary workaround.
See every vulnerability recorded for apache2 →
FAQ
CVE-2025-49812 is a vulnerability in Apache HTTP Server that allows a man-in-the-middle attacker to hijack an HTTP session through an HTTP desynchronisation attack.
Apache HTTP Server versions through 2.4.63 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, disable the 'SSLEngine optional' configuration in your Apache settings to mitigate the risk.
If exploited, this vulnerability can lead to unauthorized access to user sessions, potentially compromising sensitive data and user privacy.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
