CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.67-1~deb11u1Fixed in 2.4.67-1~deb12u2Fixed in 2.4.67-1~deb13u2Fixed in 2.4.67-1 - Upgrade
Upgrade
Apache HTTP Server (mod_ssl)to a version that resolves this vulnerability.Fixed in 2.4.64
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49812?
CVE-2025-49812 has a high severity rating due to its ability to enable man-in-the-middle attacks.
How do I fix CVE-2025-49812?
To fix CVE-2025-49812, disable the 'SSLEngine optional' directive in your mod_ssl configurations.
Which Apache HTTP Server versions are affected by CVE-2025-49812?
CVE-2025-49812 affects Apache HTTP Server versions up to and including 2.4.63.
What kind of attack does CVE-2025-49812 allow?
CVE-2025-49812 allows an HTTP desynchronisation attack that can lead to session hijacking.
Is my server vulnerable to CVE-2025-49812 if I don't use TLS upgrades?
If you do not use 'SSLEngine optional' for TLS upgrades, your server is not vulnerable to CVE-2025-49812.