Cloudanix VulnDB

CVE-2025-49630

None

CVSS

—

EPSS

1.4%

Published

Jul 10, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain web server setups lets remote attackers crash the server and make websites unavailable until it is restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Untrusted client requests trigger an assertion failure in mod_proxy_http2 when Apache HTTP Server 2.4.26-2.4.63 acts as a reverse proxy for an HTTP/2 backend with ProxyPreserveHost enabled, causing a process crash.

Why it matters to the business

Web services using the affected proxy configuration can be taken offline by remote attackers, leading to availability loss and potential downtime for dependent applications.

How an attack unfolds

An attacker sends specially crafted HTTP requests to the front-end Apache instance configured as a reverse proxy with ProxyPreserveHost on; the requests reach mod_proxy_http2 and cause an internal assertion to fail, terminating the worker process and denying service to legitimate users.

How to fix it

Upgrade Apache HTTP Server to a version beyond 2.4.63 or apply the Debian 13 package update to 6.12.35-1 (or later) that resolves the assertion in mod_proxy_http2. Disable ProxyPreserveHost or the HTTP/2 backend proxy path as a temporary mitigation if immediate patching is not possible.

How to confirm the fix worked

Verify the running Apache version is newer than 2.4.63, confirm ProxyPreserveHost is not set to on for HTTP/2 backends, and perform functional testing with proxy workloads to ensure no assertion crashes occur under load.

Typical attack path

  1. Identify publicly reachable Apache reverse-proxy instances with HTTP/2 backends and ProxyPreserveHost enabled
  2. Craft and send HTTP/2 or HTTP/1.1 requests that exercise the proxy path without valid Host headers
  3. Trigger repeated assertion failures to sustain denial of service

How to detect it

Review Apache error logs for assertion failures or segfaults originating from mod_proxy_http2, correlate with proxy access logs showing unusual Host header patterns, and monitor process restarts or worker crashes on systems running the affected versions.

  • mod_proxy_http2.*assertion
  • proxy_util.c.*ap_proxy_http2.*abort

What your security team should do

  • Prioritize patching all internet-facing Apache instances within the next maintenance window given the public disclosure and EPSS increase
  • Audit proxy configurations for ProxyPreserveHost on combined with HTTP/2 backends and remediate or document exceptions
  • Add version checks for Apache 2.4.26-2.4.63 to vulnerability scanning and asset inventory processes

The record

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:10 mod_http2 0 2.0.29-2.el10_0.1
AlmaLinux:8 httpd 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 httpd-devel 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 httpd-filesystem 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 httpd-manual 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 httpd-tools 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 mod_http2 0 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4
AlmaLinux:8 mod_ldap 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 mod_md 0 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
AlmaLinux:8 mod_md 0 1:2.0.8-8.module_el8.6.0+3031+fb177b09
AlmaLinux:8 mod_proxy_html 0 1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 mod_session 0 2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:8 mod_ssl 0 1:2.4.37-65.module_el8.10.0+4044+ea5f78b1.5
AlmaLinux:9 mod_http2 0 2.0.26-4.el9_6.1
Alpine:v3.19 apache2 0 2.4.64-r0
Alpine:v3.20 apache2 0 2.4.64-r0
Alpine:v3.21 apache2 0 2.4.64-r0
Alpine:v3.22 apache2 0 2.4.64-r0
Bitnami apache 2.4.26 2.4.64
Debian:11 apache2 0 No fix
Debian:12 apache2 0 No fix
Debian:13 apache2 0 No fix
Debian:14 apache2 0 2.4.64-1
Mageia:9 apache 0 2.4.65-1.mga9
SUSE:Linux Enterprise Module for Basesystem 15 SP6 apache2 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 apache2-prefork 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 apache2 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 apache2-event 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 apache2-devel 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 apache2-utils 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 apache2-worker 0 2.4.58-150600.5.35.1
SUSE:Linux Enterprise Server 12 SP5-LTSS apache2 0 2.4.51-35.69.1
SUSE:Linux Enterprise Server 12 SP5-LTSS apache2-tls13 0 2.4.51-35.69.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 apache2 0 2.4.51-35.69.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 apache2-tls13 0 2.4.51-35.69.1
openSUSE:Leap 15.6 apache2 0 2.4.58-150600.5.35.1
openSUSE:Leap 15.6 apache2-devel 0 2.4.58-150600.5.35.1
openSUSE:Leap 15.6 apache2-event 0 2.4.58-150600.5.35.1
openSUSE:Leap 15.6 apache2-manual 0 2.4.58-150600.5.35.1
openSUSE:Leap 15.6 apache2-prefork 0 2.4.58-150600.5.35.1
openSUSE:Leap 15.6 apache2-utils 0 2.4.58-150600.5.35.1
openSUSE:Leap 15.6 apache2-worker 0 2.4.58-150600.5.35.1
openSUSE:Tumbleweed apache2 0 2.4.64-1.1

Related vulnerabilities