EUVD-2025-21016CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Description
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.
Analysis
CVE-2025-49812 is an HTTP request smuggling/desynchronization vulnerability in Apache HTTP Server's mod_ssl that allows man-in-the-middle attackers to hijack HTTPS sessions by exploiting improper handling of TLS upgrades. Only Apache HTTP Server versions through 2.4.63 with 'SSLEngine optional' configurations are affected, enabling session hijacking with high confidentiality and integrity impact. The vulnerability requires network-level access and careful timing but does not require user interaction or privileges; upgrade to 2.4.64 (which removes TLS upgrade support entirely) is the recommended mitigation.
Technical Context
The vulnerability exploits HTTP Upgrade mechanism (RFC 7230) combined with STARTTLS-like TLS upgrade functionality in mod_ssl. When 'SSLEngine optional' is configured, Apache allows clients to negotiate TLS upgrades mid-connection via HTTP Upgrade headers and 101 Switching Protocols responses. The root cause is CWE-287 (Improper Authentication) manifested as a desynchronization between how the proxy/server interprets request boundaries during the upgrade handshake. An attacker positioned as a MITM can send crafted HTTP requests that cause the server and client to disagree on where one request ends and another begins, allowing the attacker to inject commands into an established TLS session. This is a variant of HTTP request smuggling (CWE-444) at the TLS upgrade layer. Affected CPE: cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* (versions up to 2.4.63 with mod_ssl and SSLEngine optional configuration).
Affected Products
Apache HTTP Server (2.4.0 through 2.4.63)
Remediation
- priority: CRITICAL; action: Upgrade to Apache HTTP Server 2.4.64 or later; rationale: Version 2.4.64 removes TLS upgrade support entirely, eliminating the attack surface. This is the vendor-recommended fix. - priority: HIGH; action: If upgrade is not immediately possible, remove or disable 'SSLEngine optional' configuration; rationale: Change SSLEngine directive from 'optional' to 'on' (require TLS) or 'off' to disable SSL/TLS entirely for affected virtual hosts. This prevents the upgrade mechanism that enables the attack.; config_example: Change: SSLEngine optional | To: SSLEngine on - priority: HIGH; action: Disable HTTP-to-HTTPS upgrade mechanisms; rationale: Remove or comment out HTTP Upgrade header handling and 101 Switching Protocols support if possible through mod_ssl configuration. - priority: MEDIUM; action: Implement MITM detection and network segmentation; rationale: Deploy certificate pinning on clients, use VPNs, and enforce internal TLS for server-to-server communication to reduce MITM risk while patching.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | released | 2.4.18-2ubuntu3.17+esm16 |
| upstream | released | 2.4.64-1 |
| bionic | released | 2.4.29-1ubuntu4.27+esm6 |
| focal | released | 2.4.41-4ubuntu3.23+esm2 |
| jammy | released | 2.4.52-1ubuntu4.15 |
| noble | released | 2.4.58-1ubuntu8.7 |
| plucky | released | 2.4.63-1ubuntu1.1 |
| questing | released | 2.4.64-1ubuntu1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.4.65-1~deb11u1 | - |
| bullseye (security) | fixed | 2.4.66-1~deb11u1 | - |
| bookworm | fixed | 2.4.65-1~deb12u1 | - |
| bookworm (security) | vulnerable | 2.4.62-1~deb12u2 | - |
| trixie | fixed | 2.4.66-1~deb13u2 | - |
| forky, sid | fixed | 2.4.66-8 | - |
| (unstable) | fixed | 2.4.64-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today