Medium severity6.5NVD Advisory· Published Dec 5, 2025· Updated Jun 17, 2026

CVE-2025-65082

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

Users are recommended to upgrade to version 2.4.66 which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/HTTP Server3 versions
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*range: >=2.4.0,<2.4.66
- (no CPE)range: 2.4.0 - 2.4.65
- (no CPE)range: 2.4.0
osv-coords74 versions
pkg:bitnami/apache pkg:rpm/almalinux/httpd pkg:rpm/almalinux/httpd-core pkg:rpm/almalinux/httpd-devel pkg:rpm/almalinux/httpd-filesystem pkg:rpm/almalinux/httpd-manual pkg:rpm/almalinux/httpd-tools pkg:rpm/almalinux/mod_http2 pkg:rpm/almalinux/mod_ldap pkg:rpm/almalinux/mod_lua pkg:rpm/almalinux/mod_md pkg:rpm/almalinux/mod_proxy_html pkg:rpm/almalinux/mod_session pkg:rpm/almalinux/mod_ssl pkg:rpm/opensuse/apache2&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/apache2&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/apache2-devel&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-devel&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/apache2-event&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-event&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/apache2-manual&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-manual&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/apache2-prefork&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-prefork&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/apache2-utils&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-utils&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/apache2-worker&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/apache2-worker&distro=openSUSE%20Leap%2016.0 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2&distro=SUSE%20Manager%20Proxy%20LTS%204.3 pkg:rpm/suse/apache2&distro=SUSE%20Manager%20Server%20LTS%204.3 pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/apache2-devel&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-event&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-manual&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/apache2-prefork&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-tls13&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/apache2-tls13&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/apache2-utils&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/apache2-worker&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
>= 2.4.0, < 2.4.66+ 73 more
- (no CPE)range: >= 2.4.0, < 2.4.66
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.62-7.el9_7.3
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.62-7.el9_7.3
- (no CPE)range: < 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2
- (no CPE)range: < 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.66-1.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.62-150700.4.9.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-35.75.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.51-35.75.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.51-150400.6.52.1
- (no CPE)range: < 2.4.62-150700.4.9.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.62-150700.4.9.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.62-150700.4.9.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.51-35.75.1
- (no CPE)range: < 2.4.51-35.75.1
- (no CPE)range: < 2.4.62-150700.4.9.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.62-150700.4.9.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1
- (no CPE)range: < 2.4.58-150600.5.41.1
- (no CPE)range: < 2.4.63-160000.3.1

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2025/12/04/7nvdIssue TrackingThird Party Advisory
httpd.apache.org/security/vulnerabilities_24.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000