Critical Vulnerability in Apache2: Rewrite Condition Evaluation Flaw
Summary
CVE-2025-54090: A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Affects apache2 across 2 version ranges.
< 2.4.65-r0
< 7e926454793abd7d71b6afc8bd1ec1648752c6ad
Fixed in 2.4.65-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables users to serve web content over the internet. It is known for its flexibility, security features, and extensive community support. However, a recent vulnerability has been identified in versions prior to 2.4.65, which affects the functionality of the 'RewriteCond expr ...' directive, leading to unintended behavior in URL rewriting.
Vulnerability Detail
A bug in Apache HTTP Server version 2.4.64 causes all 'RewriteCond expr ...' tests to evaluate as 'true', regardless of the actual conditions specified. This flaw can lead to improper URL handling, potentially allowing unauthorized access to resources or exposing sensitive information. The vulnerability originates from a coding error in the handling of expression conditions within the server's rewrite module.
How To Fix
Minimum fixed version
2.4.65-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'RewriteCond expr ...' directive until the upgrade is completed. Alternatively, they can implement strict access controls to mitigate the risk of unauthorized access.
Conclusion
In summary, CVE-2025-54090 is a critical vulnerability affecting Apache HTTP Server 2.4.64 that can lead to serious security implications. Users are strongly advised to upgrade to version 2.4.65 or later to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for apache2 →
FAQ
CVE-2025-54090 is a vulnerability in Apache HTTP Server 2.4.64 that causes all 'RewriteCond expr ...' tests to evaluate as 'true', potentially leading to security issues.
You can check your Apache2 version by running 'apache2 -v' in the terminal. If it is version 2.4.64 or earlier, it is affected by this vulnerability.
The risks include unauthorized access to resources and exposure of sensitive information due to improper URL handling.
Yes, upgrading to Apache HTTP Server version 2.4.65 or later will patch this vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
