Critical Security Update for Apache HTTP Server (httpd) - Multiple Vulnerabilities Addressed
Summary
ALSA-2025:23932: Important: httpd security update. Affects httpd versions < 2.4.63-4.el10_1.3. Fixed in 2.4.63-4.el10_1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely used open-source web server software that provides a robust and efficient platform for hosting web applications. It is known for its flexibility, extensibility, and strong community support. However, like any software, it is susceptible to vulnerabilities that can compromise its security and the integrity of the hosted applications.
Vulnerability Detail
This security update addresses several vulnerabilities in the Apache HTTP Server. The vulnerabilities include: 1) CGI environment variable override (CVE-2025-65082), which could allow an attacker to manipulate environment variables; 2) mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200), potentially allowing unauthorized access to user directories; and 3) Server Side Includes that improperly handle query strings in execution commands (CVE-2025-58098), which could lead to command injection. These vulnerabilities pose significant risks, including unauthorized access and execution of arbitrary commands on the server.
How To Fix
Minimum fixed version
2.4.63-4.el10_1.3
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the affected features temporarily until the update can be applied. For example, you can restrict the use of CGI scripts or modify the AllowOverride settings in your configuration files to limit potential exploitation.
Conclusion
The Apache HTTP Server has critical vulnerabilities that need to be addressed promptly to ensure the security of web applications. Updating to the latest patched version is crucial for mitigating these risks. Regular monitoring and maintenance of software components are essential for maintaining a secure environment.
See every vulnerability recorded for httpd →
FAQ
The update addresses vulnerabilities related to CGI environment variable overrides, mod_userdir+suexec bypass, and improper handling of query strings in Server Side Includes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If you cannot update immediately, consider disabling the affected features or restricting access to mitigate potential risks.
It is recommended to regularly check for updates and security advisories for all software components, ideally on a weekly basis.
For more details, refer to the CVE pages listed in the advisory or consult the official Apache HTTP Server documentation.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
