It was discovered that the Apache HTTP Server incorrectly handled certain Content-Type response headers. A remote attacker could possibly use this issue to perform HTTP response splitting attacks. (CVE-2024-42516) xiaojunjie discovered that the Apache HTTP Server mod_proxy module incorrectly handled certain requests. A remote attacker could possibly use this issue to send outbound proxy requests to an arbitrary URL. (CVE-2024-43204) John Runyon discovered that the Apache HTTP Server mod_ssl module incorrectly escaped certain data. A remote attacker could possibly use this issue to insert escape characters into log files. (CVE-2024-47252) Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj Somorovsky discovered that the Apache HTTP Server mod_ssl module incorrectly handled TLS 1.3 session resumption. A remote attacker could possibly use this issue to bypass access control. (CVE-2025-23048) Anthony CORSIEZ discovered that the Apache HTTP Server mod_proxy_http2 module incorrectly handled missing host headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2025-49630) Robert Merget discovered that the Apache HTTP Server mod_ssl module incorrectly handled TLS upgrades. A remote attacker could possibly use this issue to hijack an HTTP session. This update removes the old "SSLEngine optional" configuration option, possibly requiring a configuration change in certain environments. (CVE-2025-49812) Gal Bar Nahum discovered that the Apache HTTP Server incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. (CVE-2025-53020)
Continue reading...
Continue reading...
