High severity7.4NVD Advisory· Published Jul 10, 2025· Updated Jun 17, 2026

CVE-2025-49812

Description

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/HTTP Serverllm-fuzzy2 versions
<=2.4.63+ 1 more
- (no CPE)range: <=2.4.63
- (no CPE)range: 0
osv-coords57 versions
pkg:bitnami/apache pkg:rpm/almalinux/httpd pkg:rpm/almalinux/httpd-core pkg:rpm/almalinux/httpd-devel pkg:rpm/almalinux/httpd-filesystem pkg:rpm/almalinux/httpd-manual pkg:rpm/almalinux/httpd-tools pkg:rpm/almalinux/mod_http2 pkg:rpm/almalinux/mod_ldap pkg:rpm/almalinux/mod_lua pkg:rpm/almalinux/mod_md pkg:rpm/almalinux/mod_proxy_html pkg:rpm/almalinux/mod_session pkg:rpm/almalinux/mod_ssl pkg:rpm/opensuse/apache2-devel&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/apache2-event&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-manual&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-prefork&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-utils&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-worker&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/cyrus-imapd&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/cyrus-imapd&distro=openSUSE%20Tumbleweed pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6 pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/apache2&distro=SUSE%20Manager%20Proxy%204.3 pkg:rpm/suse/apache2&distro=SUSE%20Manager%20Server%204.3 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/apache2-tls13&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/apache2-tls13&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7
< 2.4.64+ 56 more
- (no CPE)range: < 2.4.64
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
- (no CPE)range: < 1:2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.62-4.el9_6.4
- (no CPE)range: < 1:2.4.62-4.el9_6.4
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.64-1.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 3.8.6-bp160.1.1
- (no CPE)range: < 3.8.6-1.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.62-150700.4.3.1
- (no CPE)range: < 2.4.51-150200.3.82.1
- (no CPE)range: < 2.4.51-150200.3.82.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.62-150700.4.3.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-35.69.1
- (no CPE)range: < 2.4.51-150200.3.82.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150200.3.82.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-35.69.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.51-150400.6.46.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.62-150700.4.3.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.62-150700.4.3.1
- (no CPE)range: < 2.4.51-35.69.1
- (no CPE)range: < 2.4.51-35.69.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.62-150700.4.3.1
- (no CPE)range: < 2.4.58-150600.5.35.1
- (no CPE)range: < 2.4.62-150700.4.3.1

Patches

Vulnerability mechanics

References

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

7.4/ 10

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

Probability of exploitation in the next 30 days.

0.52%

VYPR risk score

Composite of severity, exploitation, and reach.

0.41medium

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

No CWEs mapped.

CVE ID

CVE-2025-49812

Credits

JS
Jörg Schwenk (Ruhr University Bochum)
finder
JS
Juraj Somorovsky (Paderborn University)
finder
LK
Lukas Knittel (Ruhr University Bochum)
finder
MM
Marcel Maehren (Ruhr University Bochum)
finder
MB
Marcus Brinkmann (Ruhr University Bochum)
finder
NE
Nurullah Erinola (Ruhr University Bochum)
finder
RM
Robert Merget (Technology Innovation Institute)
finder
SH
Sven Hebrok (Paderborn University)
finder