CVE-2025-23048: Apache HTTP Server: mod_ssl access control bypass with session resumption
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.62, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23048?
CVE-2025-23048 has been classified as a critical severity vulnerability due to its potential to bypass access controls.
How do I fix CVE-2025-23048?
To fix CVE-2025-23048, update to Apache HTTP Server version 2.4.64 or later, which addresses the vulnerability.
Which versions of Apache HTTP Server are affected by CVE-2025-23048?
CVE-2025-23048 affects Apache HTTP Server versions 2.4.35 through 2.4.63.
What type of attack does CVE-2025-23048 involve?
CVE-2025-23048 involves an access control bypass that can be exploited by trusted clients using TLS 1.3 session resumption.
How does CVE-2025-23048 affect virtual host configurations?
CVE-2025-23048 affects mod_ssl configurations where multiple virtual hosts are restricted to different access controls.