CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
Published Jun 24, 2025
·Updated
In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.
Affected Software
9 affected componentsFixes available
Apache HTTP Server<=2.4.63
Apache HTTP Server<2.4.64
IBM Cloud Pak System<=2.3.4.0
IBM Cloud Pak System<=2.3.4.1
2.3.4.1 ifix1
IBM Cloud Pak System<=2.3.5.0
IBM Cloud Pak System<=2.3.6.0
IBM OS Image for Red Hat Linux Systems<=4.0.4.0
4.0.5.0
4.0.6.0
4.0.7.0
IBM OS Image for Red Hat Linux Systems<=5.0.0.0
5.0.1.0
debian/apache2<=2.4.62-1~deb11u1
2.4.67-1~deb11u12.4.67-1~deb12u22.4.67-1~deb13u22.4.67-1
Event History
Jun 24, 2025
Data Sourced
via Red Hat·01:49 PM
DescriptionSeverityAffected Software
Jul 10, 2025
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
DescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Jan 30, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
May 28, 2026
Data Sourced
via Ubuntu·06:16 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·06:17 PM
DescriptionAffected Software
Data Sourced
via Launchpad·06:17 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2025-49812?
CVE-2025-49812 has a high severity rating due to its ability to enable man-in-the-middle attacks.
2
How do I fix CVE-2025-49812?
To fix CVE-2025-49812, disable the 'SSLEngine optional' directive in your mod_ssl configurations.
3
Which Apache HTTP Server versions are affected by CVE-2025-49812?
CVE-2025-49812 affects Apache HTTP Server versions up to and including 2.4.63.
4
What kind of attack does CVE-2025-49812 allow?
CVE-2025-49812 allows an HTTP desynchronisation attack that can lead to session hijacking.
5
Is my server vulnerable to CVE-2025-49812 if I don't use TLS upgrades?
If you do not use 'SSLEngine optional' for TLS upgrades, your server is not vulnerable to CVE-2025-49812.