VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 10, 2025· Updated Nov 4, 2025

Apache HTTP Server: mod_ssl TLS upgrade attack

CVE-2025-49812

Description

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

Affected products

2
  • Apache/HTTP Serverllm-fuzzy
    Range: <=2.4.63
  • Apache Software Foundation/Apache HTTP Serverv5
    Range: 0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.