Skip to main content

Http Server CVE-2025-23048

| EUVDEUVD-2025-21018 CRITICAL
Improper Access Control (CWE-284)
2025-07-10 security@apache.org
Authentication Bypass Apache TLS Red Hat Http Server Suse Apache HTTP Server
Critical
Disputed · 9.1 NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates network-accessible exploitation with low complexity and no privileges required, affecting confidentiality and integrity but not availability. The vulnerability requires a specific configuration (multiple vhosts with different client certs AND SSLStrictSNIVHostCheck disabled), which narrows real-world exposure compared to the raw CVSS score. However, the combination of high CVSS, low attack complexity, and a commonly misconfigured scenario (not enabling strict SNI checks) elevates practical risk. Without EPSS, KEV, or confirmed POC data provided, the real-world exploitation probability is moderate-to-high given that: (1) the attack is fully network-based with no user interaction, (2) exploitation requires only a valid client certificate for ANY configured vhost, and (3) the misconfiguration is plausible in legacy deployments. This is a genuine priority for affected deployments, particularly those using client certificate authentication for multi-tenant access control.
Exploit ScenarioDerived

An attacker obtains valid client certificates trusted by VirtualHost-A (e.g., via legitimate access or certificate interception). The attacker uses these certificates to establish a TLS 1.3 session with VirtualHost-A and successfully authenticates. The attacker then attempts to access VirtualHost-B (which requires different client certificates) and submits a session resumption request via TLS 1.3 PSK mechanism. If SSLStrictSNIVHostCheck is not enabled, the server accepts the resumed session without re-validating the client certificate against VirtualHost-B's certificate requirements, granting unauthorized access to VirtualHost-B's protected resources. The attacker can then read confidential data or perform unauthorized modifications on VirtualHost-B. Attack complexity is low: the attacker needs valid certs for one vhost but no special tools or timing; exploitation is deterministic given the configuration. No user interaction required; fully automated exploitation is feasible.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

CVE-2025-23048 is an authentication bypass vulnerability in Apache HTTP Server 2.4.35-2.4.63 affecting mod_ssl configurations with multiple virtual hosts using different client certificate restrictions. An attacker with valid client certificates trusted by one virtual host can exploit TLS 1.3 session resumption to access another restricted virtual host if SSLStrictSNIVHostCheck is not enabled, achieving unauthorized access to confidential information and potentially modifying data. This is a network-accessible vulnerability with no authentication required and high real-world impact.

RemediationAI

  • action: Upgrade Apache HTTP Server; details: Patch to version 2.4.64 or later, which includes the fix for TLS 1.3 session resumption validation across virtual hosts
  • action: Enable SSLStrictSNIVHostCheck; details: Set 'SSLStrictSNIVHostCheck on' in all virtual host configurations that enforce per-vhost client certificate policies. This enforces strict SNI-to-vhost matching and prevents session reuse across vhosts; applicable_versions: All 2.4.35-2.4.63 (temporary mitigation pending upgrade)
  • action: Disable TLS 1.3 session resumption; details: Configure 'SSLSessionTickets off' and 'SSLSessionCache none' per virtual host to disable session resumption entirely, eliminating the attack vector (performance impact acceptable for high-security deployments); applicable_versions: Temporary workaround for 2.4.35-2.4.63
  • action: Implement additional vhost isolation; details: Use separate listening addresses (IP:port combinations) per virtual host instead of SNI-based sharing to enforce network-level isolation independent of TLS session handling

Affected VersionsENISA

Apache HTTP Server 2.4.35 ≤2.4.63

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability stems from improper session resumption handling in TLS 1.3 within mod_ssl (CWE-284: Improper Access Control). TLS 1.3 introduced stateless session resumption using Pre-Shared Keys (PSK), which allows clients to resume sessions without full re-authentication. In multi-virtual-host Apache configurations where each vhost enforces different SSLCACertificateFile/Path settings for client certificate validation, the session state may not be properly bound to the originating virtual host's certificate requirements. When SSLStrictSNIVHostCheck is disabled, SNI validation is insufficient to prevent cross-vhost session reuse. Affected CPE: cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* (versions 2.4.35 through 2.4.63). The root cause is inadequate enforcement of access control policies across session lifecycle in a multi-tenant virtual host context (CWE-284).

Know when Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Ubuntu MEDIUM
SUSE CRITICAL
Red Hat 7.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jul 10, 2025 - 17:15 nvd
CRITICAL 9.1

DescriptionCVE.org

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.

Executive ViewAI

Why It Matters

This critical vulnerability allows attackers with legitimate access to one service to bypass security controls and access restricted services on the same Apache server, potentially exposing sensitive data or systems. Organizations running Apache 2.4.35-2.4.63 with multi-tenant or multi-service SSL configurations are at immediate risk, with no vendor patch currently available.

Business Impact: Severe
Compensating Controls

Enable SSLStrictSNIVHostCheck directive on all virtual hosts; disable TLS 1.3 session resumption by setting SSLSessionTickets off; implement network segmentation to isolate virtual hosts on separate physical or containerized Apache instances; deploy WAF rules to enforce strict Host and SNI header validation; restrict client certificate trust to individual virtual hosts using separate mod_ssl directives rather than inherited configurations.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Exploit
POC
Public exploit code exists
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

66
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Http Server

View all
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-9798 HIGH POC
7.5 Sep 18

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

CVE-2014-0226 MEDIUM POC
6.8 Jul 20

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
CVE-2016-8740 HIGH POC
7.5 Dec 05

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
CVE-2026-21962 CRITICAL POC
10.0 Jan 20

Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
CVE-2020-1967 HIGH POC
7.5 Apr 21

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
CVE-2013-5704 MEDIUM POC
5.0 Apr 15

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
CVE-2013-2249 HIGH POC
7.5 Jul 23

mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
CVE-2016-5387 HIGH
8.1 Jul 19

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
CVE-2017-7668 HIGH
7.5 Jun 20

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

Ubuntu

Priority: Medium
apache2
Release Status Version
trusty needs-triage -
upstream released 2.4.64-1
jammy released 2.4.52-1ubuntu4.15
noble released 2.4.58-1ubuntu8.7
plucky released 2.4.63-1ubuntu1.1
bionic released 2.4.29-1ubuntu4.27+esm6
focal released 2.4.41-4ubuntu3.23+esm2
xenial released 2.4.18-2ubuntu3.17+esm16
questing released 2.4.64-1ubuntu1
USN-7639-1 USN-7639-2

Debian

apache2
Release Status Fixed Version Urgency
bullseye fixed 2.4.65-1~deb11u1 -
bullseye (security) fixed 2.4.66-1~deb11u1 -
bookworm fixed 2.4.65-1~deb12u1 -
bookworm (security) vulnerable 2.4.62-1~deb12u2 -
trixie fixed 2.4.66-1~deb13u2 -
forky, sid fixed 2.4.66-8 -
(unstable) fixed 2.4.64-1 -
DLA-4270-1

SUSE

Severity: Critical
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.10 Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.1.7.26.2 Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.1.8.9.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Image proxy-httpd-image Image server-image Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:13680 ADVISORY https://access.redhat.com/errata/RHSA-2025:13681 ADVISORY https://access.redhat.com/errata/RHSA-2025:14901 ADVISORY https://access.redhat.com/errata/RHSA-2025:14902 ADVISORY https://access.redhat.com/errata/RHSA-2025:14903 ADVISORY https://access.redhat.com/errata/RHSA-2025:15023 ADVISORY https://access.redhat.com/errata/RHSA-2025:15095 ADVISORY https://access.redhat.com/errata/RHSA-2025:15123 ADVISORY https://access.redhat.com/errata/RHSA-2025:15516 ADVISORY https://access.redhat.com/errata/RHSA-2025:15619 ADVISORY https://access.redhat.com/errata/RHSA-2025:15684 ADVISORY https://access.redhat.com/errata/RHSA-2025:15698 ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-23048 ADVISORY https://security-tracker.debian.org/tracker/dla-4270-1 ADVISORY https://ubuntu.com/security/notices/USN-7639-1 ADVISORY https://ubuntu.com/security/notices/USN-7639-2 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02565/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02682/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02683/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02684/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02685/ REF http://www.openwall.com/lists/oss-security/2025/07/10/2 REF http://www.openwall.com/lists/oss-security/2025/07/10/8 REF https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy