Skip to main content

Http Server CVE-2025-53020

| EUVDEUVD-2025-21015 HIGH
Memory Leak (CWE-401)
2025-07-10 security@apache.org
Denial Of Service Apache Use After Free Red Hat Http Server Suse Apache HTTP Server
7.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-401
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Impact

The risk profile is CRITICAL for most organizations. CVSS vector analysis shows: AV:N (network-accessible with no special positioning required), AC:L (low attack complexity requiring no special conditions), PR:N (no privileges needed), UI:N (no user interaction required), and C:N/I:N/A:H (high availability impact). These characteristics indicate an easily exploitable vulnerability requiring minimal attacker sophistication. The attack vector (network-based, unauthenticated, low-complexity) combined with high availability impact creates substantial real-world risk. While the CVSS does not indicate confidentiality or integrity impact, denial of service attacks against web servers are operationally significant. The broad version range affected (2.4.17-2.4.63) represents 8+ years of releases, meaning widespread exposure. Organizations running production Apache HTTP Server instances in this version range should treat this as high-priority for patching due to ease of exploitation and operational impact, regardless of EPSS or KEV status. The availability of a complete fix in version 2.4.64 further supports immediate remediation.
Exploit ScenarioDerived

An unauthenticated attacker on the internet identifies an organization running vulnerable Apache HTTP Server 2.4.60 (common in production environments). The attacker crafts specific HTTP requests or connection patterns that trigger the use-after-free condition in the server's request/memory handling code. No special tools, credentials, or user interaction are required—the attack is automated and repeatable. Each triggered use-after-free causes memory corruption, leading to process crashes or hangs. The attacker sends a high volume of these requests, causing the Apache HTTP Server to repeatedly crash or enter an unresponsive state. This results in sustained denial of service, making the web application unavailable to legitimate users. Recovery requires manual intervention (process restart) or automated restart mechanisms, during which the attacker can repeat the attack. Organizations with limited visibility into patch status across their infrastructure remain vulnerable to this attack for extended periods, particularly in complex environments with many Apache instances (shared hosting, API gateways, reverse proxies, load balancers). A public proof-of-concept or exploitation details would significantly lower the barrier to attack execution.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

CVE-2025-53020 is a late release of memory after effective lifetime vulnerability (use-after-free) in Apache HTTP Server versions 2.4.17 through 2.4.63 that allows unauthenticated remote attackers to cause denial of service with high availability impact. The vulnerability has a CVSS score of 7.5 (high severity) with network-accessible attack vector and low attack complexity, making it easily exploitable without authentication. Affected organizations running vulnerable Apache HTTP Server versions should prioritize upgrading to version 2.4.64 immediately.

RemediationAI

IMMEDIATE ACTION: Upgrade Apache HTTP Server to version 2.4.64 or later. This is the patched version that resolves CVE-2025-53020. Organizations should: (1) Test the 2.4.64 upgrade in non-production environments first to ensure compatibility with loaded modules, custom configurations, and applications; (2) Plan a phased rollout across production systems, prioritizing internet-facing servers; (3) Implement maintenance windows or use load balancing to avoid service interruption; (4) Verify successful patch installation by confirming version output and reviewing server logs for errors. TEMPORARY MITIGATION (while patching): Deploy rate-limiting and connection throttling to reduce denial-of-service attack surface; implement WAF/IDS signatures to detect potential exploitation patterns; restrict access to the HTTP server to trusted networks if operationally feasible. Workarounds are limited due to the in-process nature of the vulnerability. Complete patching is the only reliable remediation.

Affected VersionsENISA

Apache HTTP Server 2.4.17 ≤2.4.63

Affected Packages

euvd apache_http_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability stems from CWE-401 (Missing Release of Memory after Effective Lifetime), a memory management flaw where the Apache HTTP Server fails to properly deallocate memory objects after their intended use ends. This use-after-free condition occurs during the effective processing lifetime of requests or connections handled by the web server. The affected product is Apache HTTP Server (CPE: cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*), a widely-deployed open-source web server used in mission-critical infrastructure. The flaw likely exists in core request processing, memory pooling, or connection handling routines that manage the lifecycle of internal data structures. Memory corruption resulting from use-after-free can lead to crashes, heap corruption, and potential information disclosure, though this CVE specifically manifests as a denial of service vector.

Know when Http Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 5.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jul 10, 2025 - 17:15 nvd
HIGH 7.5

DescriptionCVE.org

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.

This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63.

Users are recommended to upgrade to version 2.4.64, which fixes the issue.

Executive ViewAI

Why It Matters

Apache HTTP Server versions 2.4.17 through 2.4.63 contain a memory management vulnerability (CVE-2025-53020) that could allow attackers to cause denial of service or potentially execute code. Organizations running affected versions require immediate assessment and remediation planning, as no patch is currently available.

Business Impact: High
Compensating Controls

Until patch availability: (1) Implement WAF rules to detect and block exploitation patterns targeting memory management flaws; (2) Enable request rate limiting and connection timeouts to mitigate DoS attacks; (3) Disable unused Apache modules to reduce attack surface; (4) Implement network segmentation to restrict access to affected servers; (5) Deploy intrusion detection signatures; (6) Increase logging and alerting on Apache error conditions; (7) Monitor vendor advisories for patch release timeline.

Threat Intelligence Overview

EPSS Score
0.7%
Top 29% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.7%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Http Server

View all
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-9798 HIGH POC
7.5 Sep 18

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

CVE-2014-0226 MEDIUM POC
6.8 Jul 20

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
CVE-2016-8740 HIGH POC
7.5 Dec 05

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
CVE-2026-21962 CRITICAL POC
10.0 Jan 20

Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
CVE-2020-1967 HIGH POC
7.5 Apr 21

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
CVE-2013-5704 MEDIUM POC
5.0 Apr 15

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
CVE-2013-2249 HIGH POC
7.5 Jul 23

mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
CVE-2016-5387 HIGH
8.1 Jul 19

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
CVE-2017-7668 HIGH
7.5 Jun 20

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2020-6079 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
apache2
Release Status Version
upstream released 2.4.64-1
jammy released 2.4.52-1ubuntu4.15
noble released 2.4.58-1ubuntu8.7
plucky released 2.4.63-1ubuntu1.1
trusty not-affected -
bionic released 2.4.29-1ubuntu4.27+esm6
focal released 2.4.41-4ubuntu3.23+esm2
xenial released 2.4.18-2ubuntu3.17+esm16
USN-7639-1 USN-7639-2

Debian

apache2
Release Status Fixed Version Urgency
bullseye fixed 2.4.65-1~deb11u1 -
bullseye (security) fixed 2.4.66-1~deb11u1 -
bookworm fixed 2.4.65-1~deb12u1 -
bookworm (security) vulnerable 2.4.62-1~deb12u2 -
trixie fixed 2.4.66-1~deb13u2 -
forky, sid fixed 2.4.66-8 -
(unstable) fixed 2.4.64-1 -
DLA-4270-1

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.10 Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.1.7.26.2 Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.1.8.9.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Image proxy-httpd-image Image server-image Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 Fixed

References

Advisories & patches
ADVISORY https://httpd.apache.org/security/vulnerabilities_24.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-53020 ADVISORY https://security-tracker.debian.org/tracker/dla-4270-1 ADVISORY https://ubuntu.com/security/notices/USN-7639-1 ADVISORY https://ubuntu.com/security/notices/USN-7639-2 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02565/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02682/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02683/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02684/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02685/ REF http://www.openwall.com/lists/oss-security/2025/07/10/10 REF https://lists.debian.org/debian-lts-announce/2025/08/msg00009.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy