CVE-2025-65082
Medium · 6.5CVSS
6.5
EPSS
0.8%
Published
Dec 5, 2025
CISA due date
—
The record
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | httpd | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-core | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-devel | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-filesystem | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:8 | httpd | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-devel | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-filesystem | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-manual | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-tools | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_http2 | 0 | 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4 |
| AlmaLinux:8 | mod_ldap | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_md | 0 | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 |
| AlmaLinux:8 | mod_proxy_html | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_session | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_ssl | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:9 | httpd | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-core | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-devel | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-filesystem | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-manual | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-tools | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_ldap | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_lua | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_proxy_html | 0 | 1:2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_session | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_ssl | 0 | 1:2.4.62-7.el9_7.3 |
| Bitnami | apache | 2.4.0 | 2.4.66 |
| Mageia:9 | apache | 0 | 2.4.66-1.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2 | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2-prefork | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | apache2-event | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-devel | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-utils | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-worker | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-event | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-manual | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.63-160000.3.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.66-1.1 |
Related vulnerabilities
- CVE-2025-58098 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and… Also affects httpd
- CVE-2025-66200 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Also affects httpd
- CVE-2025-55753 An integer overflow in the case of failed ACME certificate renewal leads, after a number… Also affects httpd
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects httpd
- CVE-2025-59775 Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with… Also affects apache
- CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. Also affects apache
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2