CVE-2025-66200
Medium · 5.4CVSS
5.4
EPSS
0.7%
Published
Dec 5, 2025
CISA due date
—
The record
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | httpd | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-core | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-devel | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:10 | httpd-filesystem | 0 | 2.4.63-4.el10_1.3 |
| AlmaLinux:8 | httpd | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-devel | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-filesystem | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-manual | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | httpd-tools | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_http2 | 0 | 1.15.7-10.module_el8.10.0+4044+ea5f78b1.4 |
| AlmaLinux:8 | mod_ldap | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_md | 0 | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 |
| AlmaLinux:8 | mod_proxy_html | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_session | 0 | 2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:8 | mod_ssl | 0 | 1:2.4.37-65.module_el8.10.0+4088+57f011c1.7 |
| AlmaLinux:9 | httpd | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-core | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-devel | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-filesystem | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-manual | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | httpd-tools | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_ldap | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_lua | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_proxy_html | 0 | 1:2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_session | 0 | 2.4.62-7.el9_7.3 |
| AlmaLinux:9 | mod_ssl | 0 | 1:2.4.62-7.el9_7.3 |
| Bitnami | apache | 2.4.7 | 2.4.66 |
| Mageia:9 | apache | 0 | 2.4.66-1.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2 | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | apache2-prefork | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | apache2-event | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-devel | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-utils | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | apache2-worker | 0 | 2.4.62-150700.4.9.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2-tls13 | 0 | 2.4.51-35.75.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2 | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-devel | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-event | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-manual | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-prefork | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-utils | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 15.6 | apache2-worker | 0 | 2.4.58-150600.5.41.1 |
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.63-160000.3.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.63-160000.3.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.66-1.1 |
Related vulnerabilities
- CVE-2025-58098 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and… Also affects httpd
- CVE-2025-65082 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects httpd
- CVE-2025-55753 An integer overflow in the case of failed ACME certificate renewal leads, after a number… Also affects httpd
- CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because… Also affects httpd
- CVE-2025-59775 Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with… Also affects apache
- CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. Also affects apache
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2