CVE-2025-49812: Apache HTTP Server: mod_ssl TLS upgrade attack
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49812?
CVE-2025-49812 has a high severity rating due to its ability to enable man-in-the-middle attacks.
How do I fix CVE-2025-49812?
To fix CVE-2025-49812, disable the 'SSLEngine optional' directive in your mod_ssl configurations.
Which Apache HTTP Server versions are affected by CVE-2025-49812?
CVE-2025-49812 affects Apache HTTP Server versions up to and including 2.4.63.
What kind of attack does CVE-2025-49812 allow?
CVE-2025-49812 allows an HTTP desynchronisation attack that can lead to session hijacking.
Is my server vulnerable to CVE-2025-49812 if I don't use TLS upgrades?
If you do not use 'SSLEngine optional' for TLS upgrades, your server is not vulnerable to CVE-2025-49812.