Vulnerability · Published Jul 10, 2025 · Assigned by apache
CVE-2024-47252Apache HTTP Server: mod_ssl error log variable escaping
High 7.5
In plain English
A high-severity security flaw in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:9 | httpd-core | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | httpd-devel | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-devel | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:10 | httpd-filesystem | 2.4.63-1.el10_0.2 | ALSA-2025:15095 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-filesystem | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:10 | httpd-manual | 2.4.63-1.el10_0.2 | ALSA-2025:15095 |
| AlmaLinux:8 | httpd-manual | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-manual | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | httpd-tools | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | httpd-tools | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_http2 | 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4 | ALSA-2025:15123 |
| AlmaLinux:8 | mod_ldap | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_ldap | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:9 | mod_lua | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2025:15123 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 | ALSA-2025:15123 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_proxy_html | 1:2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_session | 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_session | 2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5 | ALSA-2025:15123 |
| AlmaLinux:9 | mod_ssl | 1:2.4.62-4.el9_6.4 | ALSA-2025:15023 |
| Alpine:v3.20 | apache2 | 2.4.64-r0 | ALPINE-CVE-2024-47252 |
| Alpine:v3.21 | apache2 | 2.4.64-r0 | ALPINE-CVE-2024-47252 |
| Alpine:v3.22 | apache2 | 2.4.64-r0 | ALPINE-CVE-2024-47252 |
| Alpine:v3.23 | apache2 | 2.4.64-r0 | ALPINE-CVE-2024-47252 |
| Alpine:v3.24 | apache2 | 2.4.64-r0 | ALPINE-CVE-2024-47252 |
| Debian:12 | apache2 | 2.4.65-1~deb12u1 | DEBIAN-CVE-2024-47252 |
| Debian:13 | apache2 | 2.4.64-1 | DEBIAN-CVE-2024-47252 |
| Debian:14 | apache2 | 2.4.64-1 | DEBIAN-CVE-2024-47252 |
| Rocky Linux:10 | httpd | 0:2.4.63-1.el10_0.2 | RLSA-2025:15095 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1840+b070a976.1 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4 | RLSA-2025:15123 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 | RLSA-2025:15123 |
| Rocky Linux:9 | httpd | 0:2.4.62-4.el9_6.4 | RLSA-2025:15023 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0 | RLSA-2025:15123 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 | RLSA-2025:15123 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.15 | USN-7639-1 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.15 | UBUNTU-CVE-2024-47252 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu8.7 | USN-7639-1 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu8.7 | UBUNTU-CVE-2024-47252 |
| Ubuntu:25.10 | apache2 | 2.4.64-1ubuntu2 | UBUNTU-CVE-2024-47252 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4 – through 2.4.63 |
Weakness: CWE-150 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N