Apache HTTP Server CVE-2025-54090

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:18 vuln.today

DescriptionCVE.org

Alpine Linux: apache2 fixed in 2.4.65-r0

AnalysisAI

Apache HTTP Server (apache2) on Alpine Linux received a security fix packaged as version 2.4.65-r0. The underlying vulnerability details, including attack vector, impact class, and affected component, are not disclosed in the available intelligence - only the vendor-sourced fix notification is present. EPSS places this at the 76th percentile despite a low absolute probability (0.92%), suggesting it ranks notably above average for exploitation likelihood relative to the broader CVE population. No active exploitation (KEV) or public exploit code has been identified at time of analysis.

Technical ContextAI

Apache HTTP Server (commonly packaged as 'apache2' in Alpine Linux) is a widely deployed open-source web server. Alpine Linux packages the upstream Apache httpd project under the apache2 name and applies its own versioning suffix (e.g., 2.4.65-r0, where '-r0' is the Alpine package revision). The upstream version 2.4.65 corresponds to a release in the Apache 2.4.x stable branch. No CWE root-cause classification is provided in the available data, meaning the vulnerability class - whether it is a memory corruption, injection, authentication bypass, or other flaw - cannot be determined from the intelligence provided. No CPE strings were supplied to confirm the exact affected component or submodule within Apache.

Affected ProductsAI

Alpine Linux installations running the apache2 package at versions prior to 2.4.65-r0 are affected. This corresponds to Apache HTTP Server upstream release 2.4.x before 2.4.65, as packaged by Alpine Linux. No CPE strings were provided in the available data to further enumerate affected editions. Specific Alpine Linux release branches (e.g., edge, v3.x) affected are not identified in the available intelligence. Consult the Alpine Linux security tracker and the official Apache HTTP Server changelogs for confirmation of affected version ranges.

RemediationAI

Upgrade the Alpine Linux apache2 package to version 2.4.65-r0 or later using the Alpine package manager: 'apk update && apk upgrade apache2'. This is the vendor-confirmed fix per the Alpine Linux security advisory. No workarounds are described in the available data because the vulnerability specifics are not disclosed - generic compensating controls cannot be responsibly recommended without knowing the attack vector or affected component. If immediate patching is not possible, consider restricting external network access to the Apache HTTP Server as a precautionary measure, acknowledging that this may impact service availability. Monitor the Alpine Linux security tracker at https://security.alpinelinux.org and the Apache HTTP Server project advisories at https://httpd.apache.org/security/vulnerabilities_24.html for additional guidance as disclosure matures.