PT-2025-49183 · Apache+10 · Apache Http Server+10
Mattias Åsander
·
Published
2025-01-01
·
Updated
2026-05-28
·
CVE-2025-65082
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions 2.4.0 through 2.4.65
Description
An issue exists in Apache HTTP Server where improper neutralization of escape, meta, or control sequences can occur through environment variables set via the Apache configuration. This allows unexpectedly superseding of variables calculated by the server for CGI programs. The issue affects the handling of CGI programs and their environment variables. No information was provided regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability involves the manipulation of environment variables used by CGI programs, potentially leading to unexpected behavior or code execution. Specifically, environment variables configured in the Apache configuration can override those calculated by the server itself.
Recommendations
Upgrade to version 2.4.66 to resolve the issue.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Http Server
Centos
Debian
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Ubuntu