← All advisories

Medium severity6.3NVD Advisory· Published Jul 23, 2025· Updated Jun 17, 2026

CVE-2025-54090

CVE-2025-54090

Description

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".

Users are recommended to upgrade to version 2.4.65, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5

Apache/HTTP Server3 versions
cpe:2.3:a:apache:http_server:2.4.64:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:http_server:2.4.64:*:*:*:*:*:*:*
- (no CPE)range: 2.4.64
- (no CPE)range: <=2.4.64
osv-coords2 versions
pkg:bitnami/apache pkg:rpm/opensuse/apache2&distro=openSUSE%20Tumbleweed
>= 2.4.64, < 2.4.65+ 1 more
- (no CPE)range: >= 2.4.64, < 2.4.65
- (no CPE)range: < 2.4.65-1.1

Patches

Vulnerability mechanics

References

4

news.ycombinator.com/itemnvdIssue TrackingPatch
httpd.apache.org/security/vulnerabilities_24.htmlnvdRelease Notes
www.openwall.com/lists/oss-security/2025/07/24/2nvd
lists.debian.org/debian-lts-announce/2025/08/msg00009.htmlnvd

News mentions

0

No linked articles in our index yet.