Critical Vulnerability in Apache HTTP Server 2.4.64 - All RewriteCond expr Tests Evaluate as True
Summary
ALPINE-CVE-2025-54090: A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Affects apache2 versions < 2.4.65-r0. Fixed in 2.4.65-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, performance, and extensive feature set, including support for various modules and configurations. However, a significant vulnerability has been identified in version 2.4.64, which affects the functionality of the RewriteCond directive, potentially leading to unintended behavior in web applications.
Vulnerability Detail
A bug in Apache HTTP Server version 2.4.64 causes all 'RewriteCond expr ...' tests to evaluate as 'true', regardless of the actual conditions specified. This flaw can lead to security issues, such as unauthorized access or unintended content exposure, as it undermines the intended logic of URL rewriting rules. The vulnerability is identified as CVE-2025-54090, and it poses a serious risk to applications relying on accurate condition evaluations for routing and access control.
How To Fix
Minimum fixed version
2.4.65-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify their RewriteCond rules to avoid reliance on expressions until the upgrade can be performed. However, this is not a permanent solution and should only be used as a stopgap measure.
Conclusion
The vulnerability identified in Apache HTTP Server 2.4.64 poses a significant risk to web applications relying on URL rewriting. Users are strongly encouraged to upgrade to version 2.4.65 or later to ensure the security and proper functioning of their applications. For those unable to upgrade immediately, temporary workarounds should be employed until a permanent fix can be applied.
See every vulnerability recorded for apache2 →
FAQ
CVE-2025-54090 is a vulnerability in Apache HTTP Server 2.4.64 that causes all 'RewriteCond expr ...' tests to evaluate as 'true', potentially leading to security issues.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The risks include unauthorized access to sensitive content and unintended behavior in URL routing, which can compromise the security of web applications.
Yes, the patch is available in Apache HTTP Server version 2.4.65 and later. Users should upgrade to this version to mitigate the vulnerability.
If an immediate upgrade is not possible, consider implementing temporary workarounds by modifying your RewriteCond rules to avoid using expressions until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
