Critical Security Update for Apache HTTP Server (httpd) - Multiple Vulnerabilities Addressed
Summary
ALSA-2025:23732: Important: httpd:2.4 security update. Affects httpd versions < 2.4.37-65.module_el8.10.0+4088+57f011c1.7. Fixed in 2.4.37-65.module_el8.10.0+4088+57f011c1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely-used open-source web server software that provides a robust and flexible platform for serving web content. It supports various features including CGI, SSL/TLS, and URL rewriting, making it a popular choice among developers and system administrators. However, recent vulnerabilities have been identified that could potentially compromise the security of web applications running on affected versions of httpd.
Vulnerability Detail
The vulnerabilities in the Apache HTTP Server include a CGI environment variable override (CVE-2025-65082), unintended retry intervals in mod_md (CVE-2025-55753), a bypass of mod_userdir+suexec via AllowOverride FileInfo (CVE-2025-66200), and Server Side Includes that improperly handle query strings in #exec commands (CVE-2025-58098). These vulnerabilities can lead to unauthorized access, execution of arbitrary commands, and potential data leakage, posing significant risks to web applications.
How To Fix
Minimum fixed version
2.4.37-65.module_el8.10.0+4088+57f011c1.7
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected modules or restricting access to sensitive directories until the packages can be updated. Additionally, review the server configuration to ensure that AllowOverride directives are set appropriately to minimize exposure to the vulnerabilities.
Conclusion
In summary, the recent security vulnerabilities identified in the Apache HTTP Server require immediate attention to ensure the safety and integrity of web applications. Updating to the latest patched versions of the affected packages is crucial to mitigate the risks associated with these vulnerabilities.
See every vulnerability recorded for httpd →
FAQ
The vulnerabilities can lead to unauthorized access, execution of arbitrary commands, and potential data leakage, which can compromise the security of web applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities affect all versions of httpd prior to 2.4.37-65.module_el8.10.0+4088+57f011c1.7.
Yes, you can temporarily disable the affected modules or restrict access to sensitive directories until the packages can be updated.
More details can be found on the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
