Vulnerability · Published Jul 10, 2025 · Assigned by apache
CVE-2025-23048Apache HTTP Server: mod_ssl access control bypass with session resumption
Critical 9.1
In plain English
A critical-severity improper access control in Apache HTTP Server from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:9 | httpd-core | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | httpd-devel | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-devel | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:10 | httpd-filesystem | 2.4.63-1.el10_0.2 | ALSA-2025:15095 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-filesystem | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:10 | httpd-manual | 2.4.63-1.el10_0.2 | ALSA-2025:15095 |
| AlmaLinux:8 | httpd-manual | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-manual | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | httpd-tools | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-tools | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_http2 | 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4 | ALSA-2025:15123 |
| AlmaLinux:8 | mod_ldap | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_ldap | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:9 | mod_lua | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2025:15123 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 | ALSA-2025:15123 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_proxy_html | 1:2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_session | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_session | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_ssl | 1:2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| Alpine:v3.20 | apache2 | 2.4.64-r0 | ALPINE-CVE-2025-23048 |
| Alpine:v3.21 | apache2 | 2.4.64-r0 | ALPINE-CVE-2025-23048 |
| Alpine:v3.22 | apache2 | 2.4.64-r0 | ALPINE-CVE-2025-23048 |
| Alpine:v3.23 | apache2 | 2.4.64-r0 | ALPINE-CVE-2025-23048 |
| Alpine:v3.24 | apache2 | 2.4.64-r0 | ALPINE-CVE-2025-23048 |
| Debian:12 | apache2 | 2.4.65-1~deb12u1 | DEBIAN-CVE-2025-23048 |
| Debian:13 | apache2 | 2.4.64-1 | DEBIAN-CVE-2025-23048 |
| Debian:14 | apache2 | 2.4.64-1 | DEBIAN-CVE-2025-23048 |
| Rocky Linux:10 | httpd | 0:2.4.63-1.el10_0.2 | RLSA-2025:15095 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1840+b070a976.1 | RLSA-2025:15123 |
| Rocky Linux:9 | httpd | 0:2.4.62-4.el9_6.4 | RLSA-2025:15023 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 | RLSA-2025:15123 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.15 | USN-7639-1 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.15 | UBUNTU-CVE-2025-23048 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu8.7 | USN-7639-1 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu8.7 | UBUNTU-CVE-2025-23048 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.35 – through 2.4.63 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N