CVE-2025-55753
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Dec 5, 2025
CISA due date
—
The record
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | mod_md | 0 | 1:2.4.26-4.el10_1 |
| AlmaLinux:8 | httpd | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-devel | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-filesystem | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-manual | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-tools | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_http2 | 0 | 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4 |
| AlmaLinux:8 | mod_ldap | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_md | 0 | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 |
| AlmaLinux:8 | mod_proxy_html | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_session | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_ssl | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:9 | mod_md | 0 | 1:2.4.26-1.el9_7.1 |
| Bitnami | apache | 2.4.30 | 2.4.66 |
| Mageia:9 | apache | 0 | 2.4.66-1.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2 | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2-prefork | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | apache2-event | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-devel | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-utils | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-worker | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-event | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-manual | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.63-160000.3.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.66-1.1 |
Related vulnerabilities
- CVE-2025-58098 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and… Also affects httpd
- CVE-2025-65082 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects httpd
- CVE-2025-66200 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Also affects httpd
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects httpd
- CVE-2025-59775 Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with… Also affects apache
- CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. Also affects apache
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2