How to fix CVE-2025-65082?

Within 30 days: Identify affected systems running Apache HTTP Server and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Is Ubuntu affected by CVE-2025-65082?

Organizations using Apache HTTP Server should be aware of notable risk from CVE-2025-65082 rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

CVE-2025-65082

EUVD-2025-201404 MEDIUM

2025-12-05 [email protected]

6.5

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch Released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201404

CVE Published

Dec 05, 2025 - 11:15 nvd

MEDIUM 6.5

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

Analysis

A security vulnerability in Apache HTTP Server (CVSS 6.5). Remediation should follow standard vulnerability management procedures.

Technical Context

Vulnerability type not specified by vendor. Affects Apache HTTP Server.

Affected Products

['Apache HTTP Server']

Remediation

Monitor vendor channels for patch availability.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +32

POC: 0

Vendor Status

Ubuntu

Priority: Low

apache2

Release	Status	Version
trusty	needs-triage	-
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
upstream	released	2.4.66
plucky	ignored	end of life, was needs-triage
jammy	released	2.4.52-1ubuntu4.18
noble	released	2.4.58-1ubuntu8.10
questing	released	2.4.64-1ubuntu3.2

USN-7968-1

Debian

Bug #1121926

apache2

Release	Status	Fixed Version	Urgency
bullseye	fixed	2.4.66-1~deb11u1	-
bullseye (security)	fixed	2.4.66-1~deb11u1	-
bookworm	fixed	2.4.66-1~deb12u1	-
bookworm (security)	vulnerable	2.4.62-1~deb12u2	-
trixie	fixed	2.4.66-1~deb13u1	-
forky, sid	fixed	2.4.66-8	-
(unstable)	fixed	2.4.66-1	-

DLA-4452-1

CVE-2025-65082 vulnerability details – vuln.today

Back

CVE-2025-65082

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

CVE-2025-65082

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Vendor Status

Ubuntu

Debian

Share

External POC / Exploit Code